topic Re: Need help with below Query in Splunk Search

Need help with below Query

nilbak1 — Fri, 13 Mar 2020 08:01:08 GMT

I am running below Query

And want result in below format

Files Brand1 Brand2 Brand3
File1 123 789 125

File2 456 124 786

But result is coming as attached in picture. Whats wrong with the Query ?

Re: Need help with below Query

vnravikumar — Fri, 13 Mar 2020 08:22:22 GMT

Check this

| makeresults 
| eval data="Brand1,File1,123;Brand1,File2,456;Brand2,File1,789;Brand2,File2,124;Brand3,File1,125;Brand3,File2,786" 
| makemv data delim=";" 
| mvexpand data 
| rex field=data max_match=0 "(?<Brand>\w+\d+),(?<Files>\w+\d+)\,(?<Size>\d+)" 
| fields Brand,Files,Size 
| eval {Brand}=Size 
| fields - Brand, Size | stats values(*) as * by Files

Re: Need help with below Query

FrankVl — Fri, 13 Mar 2020 10:53:40 GMT

Indeed. Key thing here is adding the | mvexpand data. Otherwise you are working with a single row, with multivalued fields, which results in the outcome as per the screenshot.

Re: Need help with below Query

to4kawa — Sun, 15 Mar 2020 05:20:13 GMT

From your result:

| makeresults 
| eval data="Brand1,File1,123;Brand1,File2,456;Brand2,File1,789;Brand2,File2,124;Brand3,File1,125;Brand3,File2,786" 
| makemv data delim=";" 
| rex field=data max_match=0 "(?<Brand>\w+\d+),(?<Files>\w+\d+)\,(?<Size>\d+)" 
| fields - _time,data 
| table Brand,Size,Files
| rename COMMENT as "this is your sample , From here , the logic"
| eval _counter = mvrange(0,mvcount(Brand))
| stats list(*) as * by _counter
| foreach * [ eval <<FIELD>> = mvindex('<<FIELD>>' , _counter)]
| xyseries Brand Files Size
| transpose 0 header_field=Brand column_name=Files

More efficient:

| makeresults 
| eval data="Brand1,File1,123;Brand1,File2,456;Brand2,File1,789;Brand2,File2,124;Brand3,File1,125;Brand3,File2,786" 
| makemv data delim=";"
| stats count by data
| rex field=data "(?<Brand>\w+\d+),(?<Files>\w+\d+)\,(?<Size>\d+)" 
| fields - _time,data,count 
| chart sum(Size) by Files Brand

Hi folks.
Maybe, you want to extract these from JSON.
I create two query, How about these?

Re: Need help with below Query

nilbak1 — Tue, 17 Mar 2020 06:45:08 GMT

Thanks guys.

All the above suggestions are working on this sample data.
But the first suggestion by @to4kawa worked for my actual data.

The data was in text format only not sure, why other two was not working.

Once again, thanks a lot for your suggestions

Thanks
Nilesh