Splunk Search

How to combine Values Within Stats Command

whunterj
Explorer

I have written a search that breaks down the four values in the majorCustomer field and counts the number of servers in each of the four majorCustomers. What I want to do is combine the commercial and information systems customer into one called corporate and have the count be a sum of their individual server counts. Any suggestions?

This is the search:

index=citrix
| fields majorCustomer Host
| rename majorCustomer as "Line of Business"
| stats count(Host) as Servers by "Line of Business"
| eventstats sum(Servers) as Total
| eval Percentage = (Servers/Total)*100
| eval Percentage = round(Percentage, 2)
| eval Percentage = Percentage + "%"
| table "Line of Business" Servers Percentage
| sort -Servers!

alt text

0 Karma

niketn
Legend

@whunterj try the following eval after your fields pipe | eval majorCustomer=case(majorCustomer IN ("commercial","information systems"),"Corporate",true(),majorCustomer)

index=citrix majorCustomer=* Host=*
| fields majorCustomer Host
| eval majorCustomer=case(majorCustomer IN ("commercial","information systems"),"Corporate",true(),majorCustomer)
| rename majorCustomer as "Line of Business"
| stats count(Host) as Servers by "Line of Business"
| eventstats sum(Servers) as Total
| eval Percentage = (Servers/Total)*100
| eval Percentage = round(Percentage, 2)
| eval Percentage = Percentage + "%"
| table "Line of Business" Servers Percentage
| sort -Servers

PS: IN clause will work only if you are on Splunk 6.6 or higher, or else you would need to use majorCustomer=="commercial" OR majorCustomer=="information systems"

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

whunterj
Explorer

This is exactly what I was trying to do. Thank you!

woodcock
Esteemed Legend

If that's it, then click Accept to close the question.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...