Splunk仪表板图表X轴分组求助：将主机划分为Primary/Secondary组

修改后的完整查询如下：

(host = "A" OR host = "B" OR host = "C" OR host = "D" OR host = "E" OR host = "F" OR host = "G" OR host = "H") 
AND source = "logs/BAU.log"

| transaction submission_id startswith="ABC Logic begins" endswith="ABC Logic ended"

| eval group=case(
    host in ("A","B","C","D"), "Primary",
    host in ("E","F","G","H"), "Secondary"
)

| chart avg(duration) by group

关键步骤说明： #

• 新增分组字段：通过case函数结合in操作符，快速为目标host标记分组归属，把A/B/C/D归为Primary，E/F/G/H归为Secondary，逻辑简洁易维护。
• 按组聚合统计：将原查询中按host统计的逻辑改为按新生成的group字段统计，最终图表的X轴会显示Primary和Secondary两个分组，Y轴对应各组的平均执行耗时。

如果需要避免遗漏未匹配的host数据，可在case中添加默认分组：

| eval group=case(
    host in ("A","B","C","D"), "Primary",
    host in ("E","F","G","H"), "Secondary",
    1=1, "Uncategorized"
)

内容的提问来源于stack exchange，提问作者waffledood