Splunk Search

grouping multiple values of a field into one for charting

sathiyamoorthy
Explorer

Sample Data: Following is the result for a field which I'm tried to do chart for,

  • Linux - 10%
  • Unix - 10%
  • Firefox - 40%
  • Windows - 20%
  • IE - 20%

Instead of showing chart with above values, what should I do to view the following:

  • Open source - 60%
  • Commercial - 40%

Open source is the grouping of the values (Linux, Unix, Firefox), and commercial is Windows and IE. So how to group multiple values of a single field into one for charting, and how to give it some name? Any help is much appreciated, thanks.

1 Solution

Ayn
Legend

You could use eval and case to create groups like that. Let's say that your original field name is "system_id" and that you want to group values for this field and write that to the field "system_type". The, you'd do something like this:

... | eval system_type=case(system_id=="Linux" OR system_id=="Unix" OR system_id=="Firefox","Open source",system_id=="Windows" OR system_id=="IE","Commercial")

You can then use the system_type field in your chart.

View solution in original post

Ayn
Legend

You could use eval and case to create groups like that. Let's say that your original field name is "system_id" and that you want to group values for this field and write that to the field "system_type". The, you'd do something like this:

... | eval system_type=case(system_id=="Linux" OR system_id=="Unix" OR system_id=="Firefox","Open source",system_id=="Windows" OR system_id=="IE","Commercial")

You can then use the system_type field in your chart.

HattrickNZ
Motivator

can i use wild cards in the case statement? e.g. system_type=case(system_id=="Linux*" OR system_id=="Unix*")

0 Karma

mjm295
Path Finder

Did anyone get the wild cards working?

0 Karma

vsingla1
Communicator

Hi HattrickNZ and mjm295,
Wildcard does not work with case as expected. small trick is to use match within the case.
Check the answer here:
https://answers.splunk.com/answers/55524/eval-wildcards.html

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...