topic Re: Splunk values() returns swapped counts in Splunk Search

Why does Splunk values() return swapped counts?

Zoblou — Thu, 21 Apr 2022 14:41:31 GMT

Re: Splunk values() returns swapped counts

ITWhisperer — Thu, 21 Apr 2022 08:18:01 GMT

Firstly, it is unlikely that values() will return the status and count values in the order you show because values() will sort them lexicographically so Fail would be before Pass and 10 would be before 3

If you want to preserve the order use list() instead of values()

Re: Splunk values() returns swapped counts

Zoblou — Thu, 21 Apr 2022 08:20:26 GMT

Thank you so much, as you can tell I am new and still learning. But thank you for the help.

Re: Splunk values() returns swapped counts

ITWhisperer — Thu, 21 Apr 2022 08:22:27 GMT

No problem 😀 We all started out the same - welcome to your journey with Splunk!

Re: Splunk values() returns swapped counts

gcusello — Thu, 21 Apr 2022 08:22:41 GMT

Hi @Zoblou,

the problem is that the values opetion sort data for each one so the values will not correspond,

the only way is to aggregate two fields using eval and then divide after grouping, something like this:

Ciao.

Giuseppe