topic Re: How to list multiple fields separately and calculate stats? in Splunk Search

How to list multiple fields separately and calculate stats?

efaundez — Fri, 03 Aug 2018 17:47:35 GMT

good afternoon

It is possible to group in a variable the state of multiple fields? Currently I have several fields and each one has to fulfill a condition, but if this happens the state NOK must remain

index = "test" sourcetype = "test2"
| stats
max (field1) as field1,
max (field2) as field2
by _time
| eval var1 = if (field1 <9999, "NOK", var1)
| eval var2 = if (field2 <9999, "NOK", var2)
| fields - _time

In this example the values are shown to me this way and many times the NOK value, which only needs 1

Does anybody have any suggestions?

Re: How to list multiple fields separately and calculate stats?

somesoni2 — Fri, 03 Aug 2018 18:04:42 GMT

Is there some portion of query missing? You're referencing field var1 and var2 in your eval expressions (on RHS of 😃 but they don't exist after your stats command.

Re: How to list multiple fields separately and calculate stats?

kiamco — Fri, 03 Aug 2018 18:18:38 GMT

if I am understanding the question right. I believe what you want to look up is the transpose function it turns columns into rows

https://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Transpose

Re: How to list multiple fields separately and calculate stats?

efaundez — Fri, 03 Aug 2018 18:56:56 GMT

hello, the truth is the query is that but I do not know how to perform the missing part to group the values or make a state dedup and list them

Re: How to list multiple fields separately and calculate stats?

somesoni2 — Fri, 03 Aug 2018 19:13:39 GMT

Try like this

Final Answer

..base search
| stats
max (field1) as field1,
max (field2) as field2
by _time
| eval var1 = if (field1 <9999, "NOK", var1)
| eval var2 = if (field2 <9999, "NOK", var2)
| dedup var1 var2
| eval temp=0 | untable temp "N*Var" "NOK Status"
| where 'NOK Status' = "NOK"

Re: How to list multiple fields separately and calculate stats?

efaundez — Fri, 03 Aug 2018 19:34:44 GMT

Hello

Thank you very much is almost 99% of what I wanted, can you do something similar to this?

| where "NOK Status"! = "OK"

It would only filter the NOK states

Agradesco your answer.

Re: How to list multiple fields separately and calculate stats?

somesoni2 — Fri, 03 Aug 2018 19:41:24 GMT

Yes.. just add | where 'NOK Status'="NOK" to end of above search.

Re: How to list multiple fields separately and calculate stats?

efaundez — Fri, 03 Aug 2018 19:54:02 GMT

gracias por todo

Saludos

Re: How to list multiple fields separately and calculate stats?

somesoni2 — Fri, 03 Aug 2018 20:22:43 GMT

Glad to be of help. If there are no further follow-up question related to this, do remember to accept this answer to close the question.