topic Re: How to display specific fields in statistics? in Splunk Search

How to display specific fields in statistics?

wuming79 — Tue, 29 Sep 2020 14:09:40 GMT

References to tutorial http://docs.splunk.com/Documentation/Splunk/6.5.3/SearchTutorial/Searchwithfieldlookups,
sourcetype=access_* status=200 action=purchase [search sourcetype=access_* status=200 action=purchase | top limit=1 clientip | table clientip] | stats count AS "Total Purchased", dc(productId) AS "Total Products", values(productId) AS "Products ID" BY clientip | rename clientip AS "VIP Customer" will display 4 fields, "VIP Customer", "Total Purchases", "Total Products" and "Product ID".

How do I show also the Product Name in this search?

Re: How to display specific fields in statistics?

gcusello — Mon, 22 May 2017 12:49:53 GMT

HI wuming79,
where is Product_Name field?

if it's in your index, you can add to your stats command also:

values(Product_Name) AS Product_Name

if instead it's in a lookup, you have to add a row before the stats command:

sourcetype=access_ status=200 action=purchase 
[search sourcetype=access_ status=200 action=purchase | top limit=1 clientip | table clientip] 
| lookup products.csv  productId OUTPUT Product_Name 
| stats stats count AS "Total Purchased", dc(productId) AS "Total Products", values(productId) AS "Products ID" values(Product_Name) AS Product_Name BY clientip | rename clientip AS "VIP Customer".

For performance, I always prefer to insert index in my main search.

Bye.
Giuseppe

Re: How to display specific fields in statistics?

wuming79 — Tue, 23 May 2017 01:07:20 GMT

Thanks Cusello!

Re: How to display specific fields in statistics?

gcusello — Tue, 23 May 2017 08:56:44 GMT

HI wuming79,
if you're satisfied of this answer, please accept it.
Bye.
Giuseppe