topic Re: Changes in `values` function from 8.x version in Splunk Search

Changes in `values` function from 8.x version

piefragnisp — Mon, 17 Feb 2020 15:38:43 GMT

Hi,

we are testing a 8.* of Splunk version using a docker image on a POC virtual machine to migrate our 7.3.4 dev cluster.

We've noticed there is a change in values function in tstats command:

so - for example - for a query like this:

we have some difficults understanding the equivalent search in a 8.x Splunk. We tried a query like this one:

but we don't know if it's the right way because in the output we have two more columns:

with the same values of columns A and B. Do you have any suggest for this particular case or any docs in order to study these changes?

Thanks a lot.

to4kawa — Mon, 17 Feb 2020 22:14:45 GMT

changed

piefragnisp — Tue, 18 Feb 2020 08:08:40 GMT

@to4kawa thanks. We saw the doc and probably we missed something: can you show us the point in the doc answering our question?

We don't understand how to refactor our query in order to be 8.x compatible.

Thanks

to4kawa — Tue, 18 Feb 2020 09:20:03 GMT

both example #9 is easy to understand.

| tstats values(fieldA) as A, values(fieldB) as B where index=our_index  | where like(A,"%some_criteria%") OR like(A,"%some_criteria%")

your query is like above.