topic Re: multi-value field display in Splunk Search

multi-value field display

tmarlette — Mon, 28 Sep 2020 15:26:13 GMT

I have a search i'm attempting, and I'm trying to find a specific event, and eval the difference, then display that value with a few other fields, in daily buckets. I have most of it done, but this is my first experience dealing with multi value fields, and that's where i'm having my issue.

This is the query:

sourcetype=mysource1 OR sourcetype=mysource2 host=myhost1 OR host=myhost2 startdaysago=7 "sequence gap" | bucket_time span=1day | eval dif=(feed_sequence2-feed_sequence1) | stats sum(dif) by _time,handler,host

The "handler" field has multiple values in it per "host" and I'm attempting to get an output that looks something like [_time,host,handler,count] but I would need the "count" to be per "handler" per "host".

Right now when I run the query, splunk just thinks that there is only one host, and I assume it's because latest event each day is happening on the same host.

Any suggestions are greatly appreciated!!!

Re: multi-value field display

jpass — Fri, 06 Dec 2013 16:34:54 GMT

What if you break your multi-value fields into individual events with 'mvexpand':

(sourcetype=mysource1 OR sourcetype=mysource2) (host=myhost1 OR host=myhost2) startdaysago=7 "sequence gap" | mvexpand handler | bucket_time span=1day | eval dif=(feed_sequence2-feed_sequence1) | stats sum(dif) by _time,handler,host

Re: multi-value field display

tmarlette — Fri, 06 Dec 2013 16:45:15 GMT

Nope, no go. Here's the result set:

I also notice that there is an error that pops up when I use mvexpand. Take a look:

This is what happens when I remove the "handler" field:

Re: multi-value field display

jpass — Fri, 06 Dec 2013 16:49:55 GMT

Hmmm. Did you copy and paste my search? I misspelled 'handler' as 'hander'. I corrected it.

Re: multi-value field display

jpass — Fri, 06 Dec 2013 16:50:44 GMT

ah i see your error does ineed reference handler not hander.

Re: multi-value field display

tmarlette — Fri, 06 Dec 2013 17:32:02 GMT

I didn't copy and paste, but great question!!

Re: multi-value field display

prokopowicz — Fri, 06 Dec 2013 19:46:01 GMT

I have essentially the same problem. In my case, a "scenario" has multiple "slots", slots have multiple "widgets", and widgets have multiple "assets". I'm trying count the asset ID's per widget / scenario pair. (slots are not relevant in this query)

An input would look like this:


{ 
   \"scenario\": \"webv1\",   
   \"slots\": [
      {  \"name\" : \"slot1\",
         \"widgets\": [  
            {  \"type\": \"A\",
               \"assets\": [ { \"id\": \"d1\" }, 
                                 {  \"id\": \"d2\" } ]  } 
         ]
      },
      {   \"name\" : \"slot2\",
          \"widgets\": [  
           {  \"type\": \"B\",
              \"assets\": [ {  \"id\": \"d3\"} ] }
         ]
      } 
 ]
 }

The single event appears in a table like this:


scenario   widget   asset-id 
webv1      A            d1
           B            d2
                        d3

I believe I need to expand the single event into one event per asset, and then count that asset-id by the scenario&widget it appears in. The table for the above event should look like this:


scenario   widget   asset-id 
webv1      A           d1
webv1      A           d2
webv1      B           d3

But mvexpand on the asset-ids gives





webv1    A            d1

         B

webv1    A            d2

         B

webv1    A            d3

         B

The problem is how can you associate A with d1 in one event and d2 in another, and B with d3 in a third?

Here is a bonus I just picked up for working on problems like this. You can put the JSON or text for your event directly into your splunk query without having to first retrieve it from somewhere. This lets you play around with the input very quickly. Just do this:


|stats count | fields -count 
| eval response="
{ 
   YOUR JSON GOES HERE, WITH QUOTES ESCAPED
   \"scenario\": \"webv1\",   
   \"slots\": [
      {  \"name\" : \"slot1\",
         \"widgets\": [  
            {  \"type\": \"A\",
               \"assets\": [ { \"id\": \"d1\" }, 
                                 {  \"id\": \"d2\" } ]  } 
         ]
      },
      {   \"name\" : \"slot2\",
          \"widgets\": [  
           {  \"type\": \"B\",
              \"assets\": [ {  \"id\": \"d3\"} ] }
         ]
      } 
 ]
 }

" 
| spath input=response 
| search YOUR QUERY GOES HERE