I have written a search that breaks down the four values in the majorCustomer field and counts the number of servers in each of the four majorCustomers. What I want to do is combine the commercial and information systems customer into one called corporate and have the count be a sum of their individual server counts. Any suggestions?
This is the search:
index=citrix
| fields majorCustomer Host
| rename majorCustomer as "Line of Business"
| stats count(Host) as Servers by "Line of Business"
| eventstats sum(Servers) as Total
| eval Percentage = (Servers/Total)*100
| eval Percentage = round(Percentage, 2)
| eval Percentage = Percentage + "%"
| table "Line of Business" Servers Percentage
| sort -Servers!
@whunterj try the following eval after your fields pipe | eval majorCustomer=case(majorCustomer IN ("commercial","information systems"),"Corporate",true(),majorCustomer)
index=citrix majorCustomer=* Host=*
| fields majorCustomer Host
| eval majorCustomer=case(majorCustomer IN ("commercial","information systems"),"Corporate",true(),majorCustomer)
| rename majorCustomer as "Line of Business"
| stats count(Host) as Servers by "Line of Business"
| eventstats sum(Servers) as Total
| eval Percentage = (Servers/Total)*100
| eval Percentage = round(Percentage, 2)
| eval Percentage = Percentage + "%"
| table "Line of Business" Servers Percentage
| sort -Servers
PS: IN
clause will work only if you are on Splunk 6.6
or higher, or else you would need to use majorCustomer=="commercial" OR majorCustomer=="information systems"
This is exactly what I was trying to do. Thank you!
If that's it, then click Accept
to close the question.