topic Re: Top of field with multiple values in Splunk Search

Top of field with multiple values

adri9valle — Fri, 08 Mar 2019 08:10:04 GMT

Hi,

I'm trying to do a simple search that returns the top repeated values of a field.

The problem is that this field has multiple values, then when a try to exec the search, it returns 0 results.

With another field with a single value, this problem doesn't happen.

For example, let's suppose that we have this two fields; level and groups the field level contents a unique value for example 7, but the groups field can content multiples values [foo,bar,cir...]

If execute ** query *| top level limit 5 * will return the top 5 levels but if execute ** query | top groups limit 5 ** does not return anything.

How can get the top of a field with multiple values?

Thanks

Re: Top of field with multiple values

nickhills — Fri, 08 Mar 2019 12:15:08 GMT

I think you mean that the 'group' field can contain comma separated lists of values?

If I have understood that bit correctly, try:

[your search]|makemv delim="," groups|top groups limit 5

Re: Top of field with multiple values

adri9valle — Mon, 11 Mar 2019 07:20:33 GMT

Hi @nickhillscpl and @harishalipaka,

Thanks for your help, but the solution was the below:

Instead of execute:

mysearch | top rules

The execution must be:

mysearch | top rules{}

Looks seem that {} is used for fields with several values.