topic Re: stats values and data not aligning in Splunk Search

Why are stats values and data not aligning?

AK89 — Mon, 13 Jun 2022 20:27:45 GMT

In this scenario, each HOST_NAME has many HOME_LOCATIONS. Each HOME_LOCATION has unique info - in this case, the RDBMS_VERSION and the DATABASE_RELEASE.

I am trying to produce a simple statistics table that shows each unique HOME_LOCATION (and accompanying info) for each HOST_NAME.

--------------------

When I run the below (1st screen shot) the data is aligned as I'd expect it to

| stats values(HOME_LOCATION) values(RDBMS_VERSION) by HOST_NAME

When I run the below (2nd screen shot) and add the third values field in red, the data becomes misaligned for some rows

| stats values(HOME_LOCATION) values(RDBMS_VERSION) values(DATABASE_RELEASE) by HOST_NAME

What am I missing or doing incorrectly?

Re: stats values and data not aligning

ITWhisperer — Mon, 13 Jun 2022 14:21:21 GMT

values() shows the unique values sorted in lexicographical order - if you want to maintain a one-to-one correspondence use list() instead of values() however this does not dedup the values so you may end up with duplicates.

Re: stats values and data not aligning

AK89 — Mon, 13 Jun 2022 14:44:21 GMT

Appreciate the quick response! This works. As for dupes, my data is pulled in on a scheduled basis, so I can use the time range to handle dupes. Thank you!