topic Re: only keep lists with multiple values? in Splunk Search

How do I filter-out the 'resultToToss' based on the fact there's only 1 'SecondaryField' result for it?

ttovarzoll — Sun, 08 May 2022 04:37:36 GMT

I am trying to create a Splunk Alert which -- well, the details will take too long to explain 🙂

The issue is that I'm generating a stats list where some of the results have a single value while others have multiple, e.g.

PrimaryField	SecondaryField
resultToKeep	result1 result2
resultToToss	result1

How do I filter-out the 'resultToToss' based on the fact there's only 1 'SecondaryField' result for it?

Re: only keep lists with multiple values?

richgalloway — Sat, 07 May 2022 00:13:08 GMT

You can use mvcount in a where clause to filter out singletons.

| stats list... | where mvcount(SecondaryField)=1

Re: only keep lists with multiple values?

gcusello — Sat, 07 May 2022 05:33:47 GMT

Hi @ttovarzoll,

you could add a "dc" option ro your stats command, something like this:

your search | stats dc(secondaryField) AS dc_secondaryField values(secondaryField) AS secondaryField BY primaryField | where dc_secondaryField>1

that you can use for your filters.

Ciao.

Giuseppe

Re: only keep lists with multiple values?

VatsalJagani — Sat, 07 May 2022 05:36:55 GMT

@ttovarzoll - it would be >1

| where mvcount(SecondaryField)>1

Re: only keep lists with multiple values?

ttovarzoll — Mon, 09 May 2022 18:10:53 GMT

Giuseppe,

Thanks, that's a great trick! But wouldn't it lose the original values of SecondaryField?

Re: only keep lists with multiple values?

gcusello — Tue, 10 May 2022 06:09:58 GMT

Hi @ttovarzoll,

if you add (as hinted in my solution) the "values(secondaryField) AS secondaryField" option in the stats command, you don't lose it.

Ciao and happy splunking.

Giuseppe

Re: only keep lists with multiple values?

ttovarzoll — Tue, 10 May 2022 17:05:34 GMT

oh! wow, I didn't know you could do that -- list one of the original fields twice in the stats command 😁 I was seeing the dc(SecondaryField) and assumed that was the only/last reference to that field.

You've unlocked a whole new wave of discovery for me!