topic Re: Help with stats values commands in Splunk Search

When using stats to display values() of fields, how can we have the values to align between the field names?

neerajs_81 — Thu, 26 Jan 2023 19:20:09 GMT

Hi All, When using stats to display values() of fields , how can we have the values to align between the field names ? For example
My Data set

Severity	Status	Count
P1	New	1
P1	Open	2
P1	Unassigned	3
P1	Closed	5

When using | stats values(status) as status, values(Count) as Count by severity
this is what i get. Notice the count values are not as per dataset.

Severity	Status	Count
P1	New Open Unassigned Closed	1 5 3 2

i did like the results of Count to align as per their Status field.

Expected Result

Severity	Status	Count
P1	New Open Unassigned Closed	1 2 3 5

Re: Help with stats values commands

gcusello — Thu, 26 Jan 2023 11:48:51 GMT

Hi @neerajs_81,

in values option, values are sorted in alphabetically way, so yu'll never had the correct alignment between different fields, the only way is aggregate them before the stats command and separating them after, something like this:

I cannot test it but it should run!

Ciao.

Giuseppe

Re: Help with stats values commands

neerajs_81 — Thu, 26 Jan 2023 12:21:59 GMT

That worked. Thank you

Re: Help with stats values commands

gcusello — Thu, 26 Jan 2023 13:23:18 GMT

Hi @neerajs_81 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉