Splunk Search

To eliminate numbers

ncbshiva
Communicator

Hi this my search results
COUNTRY avg(TIME_TAKEN_IN_DAYS_TO_COMPLETE_THE_ORDER)
1 268647320 462.000000
2 268647324 404.000000
3 268647325 483.000000
4 268713740 90.000000
5 268755211 95.000000
6 268755212 81.000000
7 268910904 47.000000
8 ALBANIA 78.885057
9 ALGERIA 162.192308
10 ANDORRA 72.083333
11 ANGOLA 87.625000
12 ARGENTINA 131.596965
13 ARMENIA 124.333333
14 AUSTRALIA 119.199497
15 AUSTRIA 140.973917
16 AZERBAIJAN 136.800000
17 BAHAMAS 200.375000
18 BAHRAIN 102.406360

I want only countries to be displayed,i want to eliminate first numbers from COUNTRY field.

My search query is
source="-----------------------------" NOT "COUNTRY" ORDER_END_DATE!=" " | table CUS_OBJID,COUNTRY,CITY,ORDER_CREATED_DATE,ORDER_END_DATE | eval j2=ORDER_END_DATE | eval j1=ORDER_CREATED_DATE | eval d1=strptime(j1,"%d-%b-%y") |eval d2=strptime(j2,"%d-%b-%y") | eval TIME_TAKEN_IN_DAYS_TO_COMPLETE_THE_ORDER = (d2-d1)/86400 | eval TIME_TAKEN_IN_DAYS_TO_COMPLETE_THE_ORDER=round(TIME_TAKEN_IN_DAYS_TO_COMPLETE_THE_ORDER,2) |table COUNTRY,CITY,TIME_TAKEN_IN_DAYS_TO_COMPLETE_THE_ORDER | stats avg(TIME_TAKEN_IN_DAYS_TO_COMPLETE_THE_ORDER) by COUNTRY

Please help me

Tags (1)
0 Karma
1 Solution

Ayn
Legend

As a general tip regarding your search - you don't need the two table command you have in there.

You can get rid of the country values starting with a digit by adding a where command after your initial search command...

source="-----------------------------" NOT "COUNTRY" ORDER_END_DATE!=" " | where !match(COUNTRY,"^\d") | ...

View solution in original post

Ayn
Legend

As a general tip regarding your search - you don't need the two table command you have in there.

You can get rid of the country values starting with a digit by adding a where command after your initial search command...

source="-----------------------------" NOT "COUNTRY" ORDER_END_DATE!=" " | where !match(COUNTRY,"^\d") | ...

Ayn
Legend

No problem. Please mark my answer as accepted if it solved your problem.

0 Karma

ncbshiva
Communicator

thanks.................

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...