There is a complicated requirement for me, the splunk beginner. Hope you can give me some advice.
The splunk version: 9.0.2303.201
Since there are a lot of logs(events) that meet my search requirement, I want to generate a time chart with those logs.
I want to group those logs by a specific field named "field1":
For events in group A, their "field1" value is unique when compared with all other events;
For events in group B, their "field1" value has been repeated once when compared with other events, which means when I search the value of "field1"(group B), it will return two events.
Based on this premise, I want to count the event that happened times of both two groups, and display them in a timeline(time chart), what can I do?
You can use the grouping you explained with some splunk commands to accomplish that.
| windbag
| eval group = if(lang="Euro","groupA","groupB")
| timechart count by group
This is just an example with random data that you can try in your environment . You can change your grouping conditions in the if statement to your field1=your unique value.
Hello @Sanshan Would you be able to share example with values? Also, an image with the expected chart would be helpful to answer
Sure, the "field1" has a value of random UUID to mark a single trigger behavior.
But in some cases, it returns two times' logs with the same UUID, so I really need to separate the two situations(A: A unique UUID only appeared in one event; B: In two different events, they have the same UUID).
For the chart: