https://community.splunk.com/t5/Splunk-Search/Why-is-values-foo-here/m-p/266844#M80255 <P>Why is values(Authentication.user_category) here when further down there is "where Authentication.user_category=default"? The where statement would only show results when Authentication.user_category=default, but isn't values(Authentication.user_category) giving a list of all the distinct values of the field "user_category"? So wouldn't there only be one distinct value shown, "default", because that's how the search is filtering it?</P> <P>| tstats <CODE>summariesonly</CODE> max(_time) as _time,values(Authentication.user_category) as user_category,dc(Authentication.dest) as dc(dest) from datamodel=Authentication where Authentication.user_category=default by Authentication.user | <CODE>drop_dm_object_name("Authentication")</CODE> | sort 100 - _time | fields _time,user,user_category,dc(dest)</P> Tue, 29 Sep 2020 11:30:49 GMT Justin1224 2020-09-29T11:30:49Z https://community.splunk.com/t5/Splunk-Search/Why-is-values-foo-here/m-p/266844#M80255 <P>Why is values(Authentication.user_category) here when further down there is "where Authentication.user_category=default"? The where statement would only show results when Authentication.user_category=default, but isn't values(Authentication.user_category) giving a list of all the distinct values of the field "user_category"? So wouldn't there only be one distinct value shown, "default", because that's how the search is filtering it?</P> <P>| tstats <CODE>summariesonly</CODE> max(_time) as _time,values(Authentication.user_category) as user_category,dc(Authentication.dest) as dc(dest) from datamodel=Authentication where Authentication.user_category=default by Authentication.user | <CODE>drop_dm_object_name("Authentication")</CODE> | sort 100 - _time | fields _time,user,user_category,dc(dest)</P> Tue, 29 Sep 2020 11:30:49 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-values-foo-here/m-p/266844#M80255 Justin1224 2020-09-29T11:30:49Z https://community.splunk.com/t5/Splunk-Search/Why-is-values-foo-here/m-p/266845#M80256 <P>That is correct. The creator of the search may wanted to print the value of Authentication.user_category in the result hence he may've added it. It could be replaced by search like this (use an eval to create a static field).</P> <PRE><CODE>| tstats summariesonly max(_time) as _time,dc(Authentication.dest) as dc(dest) from datamodel=Authentication where Authentication.user_category=default by Authentication.user | drop_dm_object_name("Authentication") | eval user_category="default" | sort 100 - _time | fields _time,user,user_category,dc(dest) </CODE></PRE> Thu, 20 Oct 2016 14:24:19 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-values-foo-here/m-p/266845#M80256 somesoni2 2016-10-20T14:24:19Z https://community.splunk.com/t5/Splunk-Search/Why-is-values-foo-here/m-p/266846#M80257 <P>You are correct, you will only ever see the <CODE>user_category</CODE> with a value of <CODE>default</CODE> in the corresponding results. You would get the same result by removing that operator and adding <CODE>Authentication.user_category</CODE> to the <CODE>by</CODE> clause. </P> <P>It just carries the filtered value into the results. There are other ways you could do this, this is just one way.</P> Thu, 20 Oct 2016 14:26:00 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-values-foo-here/m-p/266846#M80257 rjthibod 2016-10-20T14:26:00Z