topic Re: Grouping by two fields the rest fields are missing in Other Usage

Grouping by two fields the rest fields are missing

Kubousky — Wed, 09 Feb 2022 09:56:47 GMT

I try to group by 2 fields: policy_id and client_rol but "| stats values(*) by policy_id client_rol " then the rest of fields´ values are missing.

Having following table ...

policy_id client_rol client_id client_city

001	TO	X0001	LONDON
001	AS	X0001
001	TO	X0001	LONDON
001	AS	X0001

The result I would like to get is:

policy_id client_rol client_id client_city

001	TO	X0001	LONDON
001	AS	X0001

any clue guys?

Re: Grouping by two fields the rest fields are missing

gcusello — Wed, 09 Feb 2022 10:16:57 GMT

Hi @Kubousky,

could you share the full search?

maybe the problem is before stats command, because using "| stats values(*) by policy_id client_rol", you should have all the fields.

only for precision, use:

| stats values(*) AS * BY policy_id client_rol

Ciao.

Giuseppe

Re: Grouping by two fields the rest fields are missing

Kubousky — Wed, 09 Feb 2022 15:25:50 GMT

that was it. thank u @gcusello

Re: Grouping by two fields the rest fields are missing

gcusello — Wed, 09 Feb 2022 15:32:22 GMT

Hi @Kubousky,

good for you, see next time!
Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉