Splunk Search

Need help with below Query

nilbak1
Communicator

I am running below Query

| makeresults| eval data="Brand1,File1,123;Brand1,File2,456;Brand2,File1,789;Brand2,File2,124;Brand3,File1,125;Brand3,File2,786"| makemv data delim=";" | rex field=data max_match=0 "(?<Brand>\w+\d+),(?<Files>\w+\d+)\,(?<Size>\d+)" | fields - _time,data | table Brand,Size,Files| chart values(Size) over Files by Brand

And want result in below format

Files Brand1 Brand2 Brand3
File1 123 789 125

File2 456 124 786

But result is coming as attached in picture. Whats wrong with the Query ?alt text

Tags (1)
0 Karma

nilbak1
Communicator

Thanks guys.

All the above suggestions are working on this sample data.
But the first suggestion by @to4kawa worked for my actual data.

The data was in text format only not sure, why other two was not working.

Once again, thanks a lot for your suggestions

Thanks
Nilesh

0 Karma

to4kawa
Ultra Champion

From your result:

| makeresults 
| eval data="Brand1,File1,123;Brand1,File2,456;Brand2,File1,789;Brand2,File2,124;Brand3,File1,125;Brand3,File2,786" 
| makemv data delim=";" 
| rex field=data max_match=0 "(?<Brand>\w+\d+),(?<Files>\w+\d+)\,(?<Size>\d+)" 
| fields - _time,data 
| table Brand,Size,Files
| rename COMMENT as "this is your sample , From here , the logic"
| eval _counter = mvrange(0,mvcount(Brand))
| stats list(*) as * by _counter
| foreach * [ eval <<FIELD>> = mvindex('<<FIELD>>' , _counter)]
| xyseries Brand Files Size
| transpose 0 header_field=Brand column_name=Files

More efficient:

| makeresults 
| eval data="Brand1,File1,123;Brand1,File2,456;Brand2,File1,789;Brand2,File2,124;Brand3,File1,125;Brand3,File2,786" 
| makemv data delim=";"
| stats count by data
| rex field=data "(?<Brand>\w+\d+),(?<Files>\w+\d+)\,(?<Size>\d+)" 
| fields - _time,data,count 
| chart sum(Size) by Files Brand

Hi folks.
Maybe, you want to extract these from JSON.
I create two query, How about these?

vnravikumar
Champion

Hi

Check this

| makeresults 
| eval data="Brand1,File1,123;Brand1,File2,456;Brand2,File1,789;Brand2,File2,124;Brand3,File1,125;Brand3,File2,786" 
| makemv data delim=";" 
| mvexpand data 
| rex field=data max_match=0 "(?<Brand>\w+\d+),(?<Files>\w+\d+)\,(?<Size>\d+)" 
| fields Brand,Files,Size 
| eval {Brand}=Size 
| fields - Brand, Size | stats values(*) as * by Files

FrankVl
Ultra Champion

Indeed. Key thing here is adding the | mvexpand data. Otherwise you are working with a single row, with multivalued fields, which results in the outcome as per the screenshot.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...