topic Re: stats values() doesn't return all values in Splunk Search

stats values() doesn't return all values

jorgeoa — Mon, 28 Sep 2020 20:12:24 GMT

Hello,

I'm new with splunk and I'm trying to get all the different values of a field with stats values() command with results grouped by another field. Here is the query:

src=* | eval src_act=src.".".act | stats values(vendor) as vendors dc(vendor) as num_vendors by src_act | where num_vendors>1

The maximum number of vendors returned by the query is two, but searching with the "view events" link of a result, the real number of different vendors is three or four in some cases.

The same problem occurs using the list() function, it only shows the elements from a maximum of two different vendors.

I tried to modify the list_maxsize param in limits.conf file but it doesn't solve the problem, even with the list() function, no more that 2 different values in "vendors" field.

Anybody can help me?

Thank you very much!

Regards.

Re: stats values() doesn't return all values

fdi01 — Mon, 28 Sep 2020 20:12:26 GMT

your Requette is correct also that the results obtained.
you use the where command to filter the results to the output of the stats command.
and also Reassure you that all vendors have a "src_act" because when you write "by src_act" in the command stats you also filter the results.

try like

src=* | eval src_act=src.".".act | stats values(vendor) as vendors dc(vendor) as num_vendors by src_act

src=* | eval src_act=src.".".act | stats values(vendor) as vendors |...

Re: stats values() doesn't return all values

jorgeoa — Wed, 10 Jun 2015 09:06:08 GMT

Thanks for the answer fdi01,

The problem was that the field "act" have the same values in lower and upper case, and it seems that the "by src_act" doesn't interprets that cases in the same way as the search events does (search events ignore word case but "by" not).

I solved the problem using lower() in the eval expression:

eval src_act=lower(src.".".act)

Re: stats values() doesn't return all values

jeremiahc4 — Wed, 15 Jul 2015 16:46:32 GMT

You should have accepted fdi01's answer then, instead of posting your own and accepting it.

Re: stats values() doesn't return all values

jorgeoa — Wed, 15 Jul 2015 16:57:27 GMT

Hello jeremiahc4, I appreciate the fdi01's answer but it didn't help me in solving my problem. When I found the real problem and solution by modifying the query, I posted that solution. That's why I marked my explanation as accepted.