topic Non-numerical values in a table in Splunk Search

Non-numerical values in a table

NancyCunningham — Tue, 11 May 2010 22:51:24 GMT

Trying to put together a table that compares service versions across environments.

Able to get a list using stats

 stats first(version) by service, environment

Would like to have this same info organized as a table, tried

 chart first(version) by service, environment

but this doesn't return service versions like 1.2.31

Seems that chart only works with numbers - figure there must be some other way to build a table.

Thanks, Nancy

Re: Non-numerical values in a table

sideview — Wed, 12 May 2010 00:21:22 GMT

That's right, timechart and chart do their best to only return numeric data, so first() and values() wont work as you might expect for non-numeric fields.

for more on that topic, see this related question: http://answers.splunk.com/questions/2295/how-come-some-fields-disappear-when-they-go-into-timechart-chart

So, you cant use chart, you have to use stats. And the xyseries command can convert the "stats output format", where each row is a unique combination, to what you might call the "chart output format" that's the 2-dimensional table that you want.

stats first(version) by service, environment | xyseries service, environment, first(version)

Re: Non-numerical values in a table

vbumgarn — Wed, 12 May 2010 00:37:37 GMT

I don't think this is what it was designed for, but it turns out maketable does exactly what is needed.

search... | stats first(version) as version by environment service | maketable service environment version

Re: Non-numerical values in a table

Johnvey — Wed, 12 May 2010 00:46:35 GMT

'maketable' is also known as 'xyseries'.

Re: Non-numerical values in a table

gkanapathy — Wed, 12 May 2010 05:27:15 GMT

actually that is exactly what xyseries was intended for