topic Re: Get first value of a field after filtering its row out in Splunk Search

Get first value of a field after filtering its row out

pedropiin — Mon, 17 Feb 2025 19:01:18 GMT

Hi everyone.

I'm really new to Splunk, so I'm confused with what seems to be a simple problem.
I'm using "where row_num > 1" to remove the first row of my search, as I need to calculate lots of metrics based on the whole data without this specific first row. But I'm also supposed to show the value of this first row in a specific field.

My query is of the following structure:

But I also need to output the value 'x' that is specifically on field 'y' on row 1.

How would I do this?

Thanks in advance

Re: Get first value of a field after filtering its row out

livehybrid — Mon, 17 Feb 2025 21:49:26 GMT

Hi @pedropiin

Im not 100% sure if I'm on the right page...but nevertheless have a look to see if this helps you 🙂

Ive used some sample data inline to help build out a working query for you to work with.

| makeresults | eval _raw = "[{\"name\":\"SampleMetric\",\"metric\":\"42\",\"xfield\":\"Mickey Mouse\"},{\"name\":\"SampleMetric\",\"metric\":\"17\",\"xfield\":\"Donald Duck\"},{\"name\":\"SampleMetric\",\"metric\":\"36\",\"xfield\":\"Goofy\"},{\"name\":\"SampleMetric\",\"metric\":\"29\",\"xfield\":\"Minnie Mouse\"},{\"name\":\"SampleMetric\",\"metric\":\"48\",\"xfield\":\"Pluto\"}]" | eval events=json_array_to_mv(_raw) | mvexpand events | eval _raw=events | fields _raw | spath | table name metric xfield ``` Sample data Prep work complete ``` | sort metric | streamstats count as row_num | eval xfield=IF(row_num==1,xfield,NULL()) | filldown xfield | where row_num > 1 | stats values(xfield) as xfield, avg(metric) as metric1, max(metric) as metric2, count(metric) as metric3 | fields xfield metric1, metric2, metric3

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

Re: Get first value of a field after filtering its row out

pedropiin — Tue, 18 Feb 2025 11:57:06 GMT

Hi @livehybrid

It worked perfectly!

Thank you so much