topic Re: Multyple sources display only one value in Splunk Dev

Multyple sources display only one value

andrei1bc — Wed, 15 Mar 2017 09:48:42 GMT

Hi,

How can I display in a single value chart only the value that is 2 when that occurs, or a single value 1 when other values are not present in a given time frame

Events :

source = A value = 1
source = B value = 1
source = C value = 1
source = D value = 1
..
source = A value = 1
source = B value = 2
source = C value = 1
source = D value = 1

My search :

sourcetype=test | dedup value | stats last(value)

Result :

Will only show me the value = 1 and if value = 2 occurs, I do not see it.

Please assist.

Re: Multyple sources display only one value

niketn — Wed, 15 Mar 2017 10:33:37 GMT

You just need to change from last to max()

<Your Base Search>
| stats max(value) as MaxValue by source

Re: Multyple sources display only one value

jkat54 — Wed, 15 Mar 2017 10:57:33 GMT

'stats last(value)' shows the oldest value
'stats latest(value)' shows the newest value in the index

Both require accurate timestamping and do not take into account data that could be in flight / indexing lag. Meaning the results could vary based on when you run the search and how long it takes data to "get/be" there.

I get the feeling you've greatly simplified what the possible values are and you're really looking for deviations from the common values though.

If that's the case you might be looking for something a bit more complicated like this

rootSearchHere NOT [ rootSearchHere | top 1 value by source | return $source $value] | stats values(value) by source

This would remove the top 1 most common values per source from the search and return the other values by source.

Re: Multyple sources display only one value

DalJeanis — Wed, 15 Mar 2017 18:41:08 GMT

That seems like great questionmancy. Upvote for divining the purpose of the question and aiming to solve the underlying issues rather than answer only what was asked.

Re: Multyple sources display only one value

woodcock — Wed, 15 Mar 2017 19:38:24 GMT

Like this:

 sourcetype=test | dedup value source

Or:

sourcetype=test | stats earliest(value) latest(value) min(value) max(value) avg(value) BY source

Depending on what priority you have regarding each source's value.

Re: Multyple sources display only one value

jkat54 — Wed, 15 Mar 2017 22:08:15 GMT

Cheers Mate!