https://community.splunk.com/t5/Getting-Data-In/Converting-from-multiline-field-in-table-of-result-by-stats/m-p/55403#M10805 <P>search 1 : <BR /> index=web_access_log <BR /> | stats values(src_ip) as web_src_ip, count by dst_ip</P> <P>search1's results :</P> <H2>web_src_ip dst_ip</H2> <P>123.123.123.123 111.111.111.111<BR /> 234.234.234.234</P> <H2>345.345.345.345</H2> <P>search 2 : <BR /> index=web_access_log <BR /> | stats values(src_ip) as web_src_ip, count by dst_ip<BR /> | geoip dst_ip</P> <P>search2's results</P> <H2>web_src_ip dst_ip dst_ip_country_name</H2> <P>123.123.123.123 234.234.234.234 345.345.345.345 111.111.111.111 country_name</P> <P>After applying geoip command, the result of search2 shows in single-line form.<BR /> However, what I really wanted to show is to use geoip to result in multi-line form.<BR /> So, any suggestion? How can that be done?</P> Mon, 28 Sep 2020 13:28:29 GMT joy76 2020-09-28T13:28:29Z https://community.splunk.com/t5/Getting-Data-In/Converting-from-multiline-field-in-table-of-result-by-stats/m-p/55403#M10805 <P>search 1 : <BR /> index=web_access_log <BR /> | stats values(src_ip) as web_src_ip, count by dst_ip</P> <P>search1's results :</P> <H2>web_src_ip dst_ip</H2> <P>123.123.123.123 111.111.111.111<BR /> 234.234.234.234</P> <H2>345.345.345.345</H2> <P>search 2 : <BR /> index=web_access_log <BR /> | stats values(src_ip) as web_src_ip, count by dst_ip<BR /> | geoip dst_ip</P> <P>search2's results</P> <H2>web_src_ip dst_ip dst_ip_country_name</H2> <P>123.123.123.123 234.234.234.234 345.345.345.345 111.111.111.111 country_name</P> <P>After applying geoip command, the result of search2 shows in single-line form.<BR /> However, what I really wanted to show is to use geoip to result in multi-line form.<BR /> So, any suggestion? How can that be done?</P> Mon, 28 Sep 2020 13:28:29 GMT https://community.splunk.com/t5/Getting-Data-In/Converting-from-multiline-field-in-table-of-result-by-stats/m-p/55403#M10805 joy76 2020-09-28T13:28:29Z https://community.splunk.com/t5/Getting-Data-In/Converting-from-multiline-field-in-table-of-result-by-stats/m-p/55404#M10806 <P>geoip is a python command and I think it can be tricky to get a python command to handle multivalue fields correctly. This might be thus a problem in geoip, but I don't know for sure. At any rate, you can cheat! </P> <P>use streamstats to paint a row number, use mvexpand to blow out the N x mv fields into N rows of single value fields, wash through geoip, then do stats values by rowIndex to compact it back into your mv form. </P> <PRE><CODE>index=web_access_log | stats values(src_ip) as web_src_ip, count by dst_ip | streamstats count as rowIndex | mvexpand web_src_ip | geoip dst_ip | stats values(web_src_ip) as web_src_ip values(dst_ip) as dst_ip values(dst_ip_country_name) as dst_ip_country_name by rowIndex </CODE></PRE> <P>You can strip off the last few pipes and run it pipe by pipe and that'll help you understand how it works. </P> Fri, 08 Mar 2013 05:55:11 GMT https://community.splunk.com/t5/Getting-Data-In/Converting-from-multiline-field-in-table-of-result-by-stats/m-p/55404#M10806 sideview 2013-03-08T05:55:11Z