Sample Data: Following is the result for a field which I'm tried to do chart for,
Instead of showing chart with above values, what should I do to view the following:
Open source is the grouping of the values (Linux, Unix, Firefox), and commercial is Windows and IE. So how to group multiple values of a single field into one for charting, and how to give it some name? Any help is much appreciated, thanks.
You could use eval
and case
to create groups like that. Let's say that your original field name is "system_id
" and that you want to group values for this field and write that to the field "system_type
". The, you'd do something like this:
... | eval system_type=case(system_id=="Linux" OR system_id=="Unix" OR system_id=="Firefox","Open source",system_id=="Windows" OR system_id=="IE","Commercial")
You can then use the system_type
field in your chart.
You could use eval
and case
to create groups like that. Let's say that your original field name is "system_id
" and that you want to group values for this field and write that to the field "system_type
". The, you'd do something like this:
... | eval system_type=case(system_id=="Linux" OR system_id=="Unix" OR system_id=="Firefox","Open source",system_id=="Windows" OR system_id=="IE","Commercial")
You can then use the system_type
field in your chart.
can i use wild cards in the case
statement? e.g. system_type=case(system_id=="Linux*" OR system_id=="Unix*")
Did anyone get the wild cards working?
Hi HattrickNZ and mjm295,
Wildcard does not work with case as expected. small trick is to use match within the case.
Check the answer here:
https://answers.splunk.com/answers/55524/eval-wildcards.html