Search code examples
group-bysplunksplunk-query

Splunk: Group by certain entry in log file

I did this query in Splunk:

source="/log/ABCD/cABCDXYZ/xyz.log" doSomeTasks|timechart partial=f span=1h count as "#XYZ doSomeTasks" |fillnull

This query works out fine. Now, I would like to group this results by another entry in my log file. This entry is taskType. taskType can be either One, Two or Three. One, Two or Three are also entries after taskType.

How could I do this?

Solution

  • Add a by clause to your timechart:

    source="/log/ABCD/cABCDXYZ/xyz.log" doSomeTasks
| timechart partial=f span=1h count as "#XYZ doSomeTasks" by taskType
| fillnull