Issue getting multi-value field to correlate properly

burras — Tue, 29 Sep 2020 18:43:49 GMT

I have an existing data set that provides a dump of multiple data points in a single event. The data set looks something like this:

HOSTNAME = "NODE1"
License Type: MAIN INSTALLED.Count: 1 Mainboard: 0 I/O 1: 0 MFP 2: 0 Total Licenses in Use: 0
License Type: TRANSRATE INSTALLED.Count: 12 Mainboard: 0 I/O 1: 0 MFP 2: 0 Total Licenses in Use: 9
License Type: EXTENSION is NOT INSTALLED

And the data set continues with about 50 more license types per node. I've been able to set up extraction of various fields (node, license_type, license_avail, license_used) using props.conf and transforms.conf:

props.conf
[license]
EXTRACT-hostname = HOSTNAME=\"(?<node>\w+)\"
REPORT-license_type = license_type
REPORT-license_available = license_available
REPORT-license_used = license_used

transforms.conf
[license_type]
REGEX = License\sType:\s(?<license_type>\w+)\sINSTALLED\.Count
FORMAT = license_type::$1
MV_ADD = true

[license_available]
REGEX = INSTALLED\.Count\s(?<license_avail>\d+)\s+
FORMAT = license_avail::$1
MV_ADD = true

[license_used]
REGEX = \s+Total\sLicenses\sin\sUse:\s(?<license_used>\d+)
FORMAT = license_used::$1
MV_ADD = true

These seem to be working fine - I'm able to extract and see a list of all of the available licenses on the system (i.e. MAIN, TRANSRATE); the count of all available licenses (i.e. 1, 12), and the count of licenses actually in use (i.e. 0, 9). The problem I'm having is correlating this data together in an actual report for the users. I can't seem to make the numbers line up properly. I've tried numerous stats, charts, and other commands, but can't seem to make it line up into what should be a fairly simple report - For each node, list installed license types with a count of licenses available and licenses in use:

Host Type Available Used
NODE1 MAIN 1 0
NODE1 TRANSRATE 12 9

What I've ended up with is usually the same values for each license type or a completely unordered list with no correlation between the counts and the license type. Some of the searches I've used are:

|stats values(license_type) values(license_avail) values(license_used) by node    - returns uncorrelated list of numbers

|stats latest(license_type) latest(license_avail) latest(license_used) by node        - returns visually what I'm looking for but only 1 license type per node

I'm sure there's something pretty simple that I'm missing here but I appreciate any help...

Re: Issue getting multi-value field to correlate properly

somesoni2 — Wed, 28 Mar 2018 23:27:12 GMT

Try these

Use list function of stats instead of values. The values function gives sorted , unique values of the field hence the non-correlated ordering

your base search
|stats list(license_type) list(license_avail) list(license_used) by node

OR, make the report linear by expanding multivalued fields.

your base search
| fields node license_type license_avail license_used
| eval temp=mvzip(mvzip(license_type,license_avail,"##"),license_used,"##")
| mvexpand temp 
| rex field=temp "(?<license_type>[^#]+)##(?<license_avail>[^#]+)##(?<license_used>.+)"
| table node license_type license_avail license_used

Re: Issue getting multi-value field to correlate properly

burras — Fri, 30 Mar 2018 15:34:10 GMT

Thanks - using list fixed up the issue. Appreciate the help!

topic Re: Issue getting multi-value field to correlate properly in Splunk Dev

Issue getting multi-value field to correlate properly

Re: Issue getting multi-value field to correlate properly

Re: Issue getting multi-value field to correlate properly