Picking only the first value in search query

[aditsss]

Hi All,

Below is my log data

2020-09-30T05:15:41.732035345Z app_name=api environment=2 ns=ab-c2 integrationType=PULL_GR_FILE_UPLOAD, integrationType=LR_JSON, callbackConfig, integrationType=PUSH_S3_GRS

I made the search query like this:

<query>index=abc ns=ab app_name=ui|stats count by integrationType</query>

The issue I am facing is I am only getting first IntegartionType that is "PULL_GR_FILE_UPLOAD" and its count. Its not taking other integrationType. The log contains 2-3 integration type for a particular date.

Can someone guide me where I am going wrong.

Attached is the screenshot.

[ITWhisperer]

Assuming you have extracted integrationType into a multi-value field, you need to expand this before the stats

<query>index=abc ns=ab app_name=ui|mvexpand integrationType|stats count by integrationType</query>

[aditsss]

@ITWhisperer  @gcusello 

I have not extracted it . It was coming in splunk selected fields.

But its only picking the first.  Not sure where I am going wrong.

Can someone guide me.

[ITWhisperer · Accepted solution]

The fact that they appear in selected fields means that they have been extracted. I suspect this extraction is not taking into account that the integrationType may appear multiple times in the event. Either fix the extraction or add it to your query

<query>index=abc ns=ab app_name=ui
| rex max_match=0 "integrationType=(?<integrationType>[^,]+)"
| stats count by integrationType</query>

[aditsss]

@ITWhisperer 

It works exactly the way I want. Thank you so much.

[gcusello]

Hi @aditsss,

if you want the most numerous, you can try this:

index=abc ns=ab app_name=ui
| stats count by integrationType
| sort -count
| head 1

Ciao.

Giuseppe

[gcusello]

Hi @aditsss,

if you haven't the fields that you're using in the search, you have to extract all of them: ns, appName and integrationType.

You can use the hint of @ITWhisperer using rex command or you can use the guided web field extractor and then use them.

Ciao.

Giuseppe