topic Re: using 'values' in stats shows values merged in Splunk Search

using 'values' in stats shows values merged

beriwalnishant — Mon, 20 Nov 2023 05:29:13 GMT

Hello Experts,

I was wondering if you can help me figure out how do I show the merged values in a field as 'unmerged' when use 'values' in stats command

(DETAILS_SVC_ERROR) and (FARE/PRCNG/AVL-MULT. RSNS) are different values .... coming as merged as an example, its merging all values in one when used "Values" OR "List" how to unmerge same

If I use 'mvexpand' it then expands to single count even if the values are same

Thanks in advance

Nishant

Re: using 'values' in stats shows values merged

ITWhisperer — Mon, 20 Nov 2023 09:11:04 GMT

You are correct, mvexpand of a values() or list() field will duplicate the event. If you want to count by ErrorCode separately, include ErrorCode in your by clause of the stats command.

Re: using 'values' in stats shows values merged

beriwalnishant — Tue, 21 Nov 2023 03:51:29 GMT

But then I dont get the individual Totals if I do that along with the message.

Re: using 'values' in stats shows values merged

ITWhisperer — Tue, 21 Nov 2023 09:17:55 GMT

Perhaps it would be better for you to show what it is that you do want?

Re: using 'values' in stats shows values merged

PickleRick — Tue, 21 Nov 2023 13:50:29 GMT

Well, this is how it's supposed to work. list() or values() gives you a multivalued field with a list of values.

If you need something else, you need to do something else.