topic Re: Where condition not working for a multiple value field in Splunk Search

Where condition not working for a multiple value field

neerajs_81 — Fri, 12 Nov 2021 07:57:42 GMT

Hello All,
I have a search that uses stats command and displays the results as follows. Note: I have stripped out some columns.

index=index1 sourceType=xxxx | eventstats count(action) as Per_User_failures by user | stats latest(_time) as _time, values(host), values(src_ip), dc(src_ip) as srcIpCount, values(user), values(Failure_Reason), dc(user) as userCount, values(Per_User_failures) as Per_User_failures by Workstation_Name

neerajs_81_0-1636703489315.png

Now, if i further add | where Per_User_failures > 10 condition, the search shows "No Results Found".

This is incorrect as you can see there are some values where Per_user_Failures is greater than 10 such as 11,12,13, 1037 etc.
How can i make the where clause check any of the values under the "Per_user_failures" column.

Re: Where condition not working for a multiple value field

kamlesh_vaghela — Fri, 12 Nov 2021 08:21:56 GMT

@neerajs_81

Can you please replace this with your where condition?

| mvexpand Per_User_failures | where Per_User_failures>10 | stats values(*) as * by Workstation_Name

If it is works, you can redefine your search and make it possible with only one stats if possible.

Thanks
KV
▄︻̷̿┻̿═━一 😉

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: Where condition not working for a multiple value field

neerajs_81 — Fri, 12 Nov 2021 08:50:44 GMT

Hi Kamlesh, i tried using | mvexpand Per_User_failures | where Per_User_failures>10 ,
it appears to be working obviously but the results in the "Per_User_failures" column no longer shows the count of failures per user level. It is now showing only a single value ( which i think is the total of all failures) .

I want the search results to continue displaying count of failures of every user in the "Per_User_failures" column as it was before which is why i am using evenstats to show me the data per user.

This is what i mean :
Before: ( as per my screenshot earlier) . It shows failures of every user :

User	userCount	Per_User_Failures
John Alice	2	5 10
Alex John Jamie Alicia	4	13 1037 12 1

After adding | mvexpand Per_User_failures | where Per_User_failures>10

User	userCount	Per_User_Failures
John Alice	2	12
Alex John Jamie Alicia	4	868

Re: Where condition not working for a multiple value field

kamlesh_vaghela — Fri, 12 Nov 2021 11:47:38 GMT

@neerajs_81

I hope you tried same I shared.

I'm sharing my sample search with you. I hope this will help you.

Re: Where condition not working for a multiple value field

neerajs_81 — Fri, 12 Nov 2021 11:54:30 GMT

Thank you