topic Re: How to split count by product by another value? in Splunk Search

How to split count by product by another value?

maxmukimov — Mon, 03 May 2021 20:01:17 GMT

Hi, I have the following query:

| bin _time span=1d | stats count as ProductCount by applysourcetype, product, _time | where _time=relative_time(now(), "-d@d") or _time=relative_time(now(), "-8d@d") | eval when = if(_time=relative_time(now(), "-d@d"), "(Yesterday)", "(7 Days Ago)") | eval "Products Ordered {when}" = ProductCount | fields - _time ProductCount when | stats values(*) as * by product , applysourcetype

and I'm getting following output:

How can make product filed one row for unique product?

Re: How to split count by product by another value?

s2_splunk — Mon, 03 May 2021 20:24:47 GMT

| mvexpand product

at the end of your search should do the trick. mvexpand docs here.

Re: How to split count by product by another value?

maxmukimov — Mon, 03 May 2021 20:33:47 GMT

Getting the same results when I added

| mvexpand product

Re: How to split count by product by another value?

ITWhisperer — Mon, 03 May 2021 21:20:40 GMT

| stats list(*) as * by product

Re: How to split count by product by another value?

maxmukimov — Tue, 04 May 2021 14:31:53 GMT

got this

Re: How to split count by product by another value?

ITWhisperer — Tue, 04 May 2021 15:18:06 GMT

One unique product per row - which is what you said. If this is not what you wanted, perhaps you can give an example of what you were expecting?

Re: How to split count by product by another value?

maxmukimov — Tue, 04 May 2021 17:44:50 GMT

From original query I’m getting something like this :

I want to get something like this:

Re: How to split count by product by another value?

ITWhisperer — Wed, 05 May 2021 07:49:37 GMT

The standard table view doesn't merge cells across rows. Using stats list(*) as * by product should at least group the fields into multi-value lists which is close to what you want. If you still want separate rows for the counts, with blank entries in the product column for subsequent rows for the same product, you could use some CSS to hide them. This is a little fiddly to do but possible.