https://community.splunk.com/t5/Splunk-Search/How-to-aggregate-results-based-on-a-set-of-values/m-p/481168#M134833 <P>Hello, </P> <P>Why you don't use the IN to filter request:</P> <PRE><CODE>index=_internal name IN ("management","ingest") </CODE></PRE> <P>in your case:</P> <PRE><CODE>index=someIndex "attr1"=aConstant attr2="aValue" filterCriteria="Criteria1" | table _time, resultValue1, resultValue2, resultValue3 | sort _time </CODE></PRE> Thu, 09 Jan 2020 16:09:01 GMT TISKAR 2020-01-09T16:09:01Z https://community.splunk.com/t5/Splunk-Search/How-to-aggregate-results-based-on-a-set-of-values/m-p/481166#M134831 <P>Hello all,</P> <P>I have the following query:</P> <PRE><CODE>index=someIndex "attr1"=aConstant attr2="aValue" filterCriteria="Criteria1" | table _time, resultValue1, resultValue2, resultValue3 | sort _time </CODE></PRE> <P>Quick explanation of the fields:</P> <OL> <LI>attr1/2: these are some filters which have constants. Those are "irrelevant" to my problem right now.</LI> <LI>filterCriteria: The above query has one value as a filter, but I need to filter by two values. This means something like <CODE>filterCriteria in("Criteria1", "Criteria2")</CODE>.</LI> </OL> <P>For achieving this, I tried to use <CODE>join</CODE> of two separate queries, based on the <CODE>filterCriteria</CODE> attribute, like this:</P> <PRE><CODE>index=someIndex "attr1"=aConstant attr2="aValue" filterCriteria="Criteria1" | join filterCriteria [search index=someIndex "attr1"=aConstant attr2="aValue" filterCriteria="Criteria2"] | table _time, resultValue1, resultValue2, resultValue3 | sort _time </CODE></PRE> <P>But it seems that it's returning only the values of the last part of the join instead.</P> <P><CODE>resultValue1/2/3</CODE> are fields with values shared by both queries, so they can be aggregated.</P> <P>Is there a most efficient/another way to achieve this filtering by multivalued / <CODE>in</CODE>-like criteria?</P> <P>Thanks in advance! </P> Thu, 09 Jan 2020 13:57:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-aggregate-results-based-on-a-set-of-values/m-p/481166#M134831 alejandrome 2020-01-09T13:57:53Z https://community.splunk.com/t5/Splunk-Search/How-to-aggregate-results-based-on-a-set-of-values/m-p/481167#M134832 <PRE><CODE>(index=someIndex "attr1"=aConstant attr2="aValue" filterCriteria="Criteria1" ) OR (index=someIndex "attr1"=aConstant attr2="aValue" filterCriteria="Criteria2" ) | stats values(_time) as _time , values(resultValue1) as resultValues1, values(resultValue2) as resultValues2, values(resultValue3) as resultValues3 by filterCriteria | sort _time </CODE></PRE> <P>try <CODE>stats</CODE> with <EM>by</EM> .</P> Thu, 09 Jan 2020 14:47:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-aggregate-results-based-on-a-set-of-values/m-p/481167#M134832 to4kawa 2020-01-09T14:47:59Z https://community.splunk.com/t5/Splunk-Search/How-to-aggregate-results-based-on-a-set-of-values/m-p/481168#M134833 <P>Hello, </P> <P>Why you don't use the IN to filter request:</P> <PRE><CODE>index=_internal name IN ("management","ingest") </CODE></PRE> <P>in your case:</P> <PRE><CODE>index=someIndex "attr1"=aConstant attr2="aValue" filterCriteria="Criteria1" | table _time, resultValue1, resultValue2, resultValue3 | sort _time </CODE></PRE> Thu, 09 Jan 2020 16:09:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-aggregate-results-based-on-a-set-of-values/m-p/481168#M134833 TISKAR 2020-01-09T16:09:01Z