topic Re: Aggregate only some results in Splunk Search

Aggregate only some results

PickleRick — Fri, 22 Oct 2021 07:56:12 GMT

I'll probably find my solution finally but if someone has something at hand, I'd be grateful for sharing 🙂

I have some results. Let's say they are like this:

Count	FieldA	FieldB
11	a
12	b
34	c	1
54	d	1
462	e
0	f	3
12	g	3
4	h	3

I would like the values from the count column summed up but only for the events that have FieldB defined. For the rest, I want them lest split by FieldA. For those summed up I want the FieldA to be aggregated into a multivalue field

So effectively the output should be like

Count	FieldA	FieldB
11	a
12	b
88	c d	1
462	e
16	f g h	3

OK. I think I can get it done by adding another column being created conditionally either from fieldA or fieldB, then aggregating by this field. Something like this:

<initial search>
| eval tempfield=if(isnull(fieldB),"fieldA-".fieldA,"fieldB-".fieldB)
| stats sum(count) as count values(fieldA) as fieldA values(fieldB) as fieldB by tempfield
| fields - tempfield

Any nicer way?

Re: Aggregate only some results

ITWhisperer — Fri, 22 Oct 2021 10:22:27 GMT

Not sure if this is nicer, but would this work?

Re: Aggregate only some results

PickleRick — Fri, 22 Oct 2021 11:19:30 GMT

Seems to produce the same results although no offence but I since those temporary fields are getting quite huge I'd not call that nicer 😉

But it's an interesting approach. I keep forgetting about eventstats. Thanks for the insight!