Splunk Search

Want to split results based on a field value

leandrot
Explorer

Hi all,

We have a field which represets de Offices, and we would like to make 2 different line charts separating between Domestic offices and International offices.

As Example we have:

Domestic offices: PHX, LAX, LGA
International offices: BUE, LIM, MEX

How can we filter the results to dispaly on each graphic the corresponding offices ?

Thanks in advance

Tags (1)
0 Karma

TISKAR
Builder

@leandrot , Can you try this please:

<yourSearch> |eval TypeOffice=if(Offices="PHX" OR Offices="LAX" OR Offices="LGA","Domestic offices","International offices") | chart count over Offices by TypeOffice
0 Karma
Get Updates on the Splunk Community!

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Dashboard Challenge and Watch the .conf24 Global Broadcast!

The Splunk Community Dashboard Challenge is still happening, and it's not too late to enter for the week of ...