Splunk Search

To eliminate numbers

ncbshiva
Communicator

Hi this my search results
COUNTRY avg(TIME_TAKEN_IN_DAYS_TO_COMPLETE_THE_ORDER)
1 268647320 462.000000
2 268647324 404.000000
3 268647325 483.000000
4 268713740 90.000000
5 268755211 95.000000
6 268755212 81.000000
7 268910904 47.000000
8 ALBANIA 78.885057
9 ALGERIA 162.192308
10 ANDORRA 72.083333
11 ANGOLA 87.625000
12 ARGENTINA 131.596965
13 ARMENIA 124.333333
14 AUSTRALIA 119.199497
15 AUSTRIA 140.973917
16 AZERBAIJAN 136.800000
17 BAHAMAS 200.375000
18 BAHRAIN 102.406360

I want only countries to be displayed,i want to eliminate first numbers from COUNTRY field.

My search query is
source="-----------------------------" NOT "COUNTRY" ORDER_END_DATE!=" " | table CUS_OBJID,COUNTRY,CITY,ORDER_CREATED_DATE,ORDER_END_DATE | eval j2=ORDER_END_DATE | eval j1=ORDER_CREATED_DATE | eval d1=strptime(j1,"%d-%b-%y") |eval d2=strptime(j2,"%d-%b-%y") | eval TIME_TAKEN_IN_DAYS_TO_COMPLETE_THE_ORDER = (d2-d1)/86400 | eval TIME_TAKEN_IN_DAYS_TO_COMPLETE_THE_ORDER=round(TIME_TAKEN_IN_DAYS_TO_COMPLETE_THE_ORDER,2) |table COUNTRY,CITY,TIME_TAKEN_IN_DAYS_TO_COMPLETE_THE_ORDER | stats avg(TIME_TAKEN_IN_DAYS_TO_COMPLETE_THE_ORDER) by COUNTRY

Please help me

Tags (1)
0 Karma
1 Solution

Ayn
Legend

As a general tip regarding your search - you don't need the two table command you have in there.

You can get rid of the country values starting with a digit by adding a where command after your initial search command...

source="-----------------------------" NOT "COUNTRY" ORDER_END_DATE!=" " | where !match(COUNTRY,"^\d") | ...

View solution in original post

Ayn
Legend

As a general tip regarding your search - you don't need the two table command you have in there.

You can get rid of the country values starting with a digit by adding a where command after your initial search command...

source="-----------------------------" NOT "COUNTRY" ORDER_END_DATE!=" " | where !match(COUNTRY,"^\d") | ...

Ayn
Legend

No problem. Please mark my answer as accepted if it solved your problem.

0 Karma

ncbshiva
Communicator

thanks.................

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...