Dashboards & Visualizations

show multiple fields in table after using a mvexpand in a query

fsiemons
Engager

Hi I am looking at data which includes a field with multiple lines of values. For instance:

$name$, $products$, $country$

============================

an example of an event:

name:
Peter Thompson

products:
windows 10
office 2017
adobe reader 9

country:
Germany

============================

What I am trying to achieve is a table like:
name products country
Peter Thompson Windows 10 Germany
Peter Thompson Office 2017 Germany
Peter Thompson Adobe Reader 9 Germany

============================

To do this I am using mvexpand on the products field which gives me the separated products and sorts them by rarity. I cannot however seem to create a table after that which pulls back the other values such as the name and country. It appears that after the mvexpand or the rare functions, all other fields are lost.

============================

My query:

index=data sourcetype=stuff | mvexpand products | rare limit=10 products | eventstats count AS total by products, name | table count, name

Tags (1)
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

The problem is that the rare command returns only the relevant fields.

Here's one way

index=data sourcetype=stuff 
| mvexpand products 
| appendpipe [| rare limit=10 products | eval myflag="keepme"]
| stats count AS total values(myflag) as myflag values(country) as country by products, name 
| where myflag="keepme"
| fields - myflag
| eval total = total - 1

The last line is subtracting the 1 record added by the appendpipe.

0 Karma

fsiemons
Engager

Thank you. I have tried that. Unfortunately whatever gets a "keepme" flag still looses all the other field values along the way...

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

Hi @fsiemons,

Sorry the above answer didn't answer your question. I'm sure help is on the way!

But, in the mean time,If you want to try to get some immediate help for your question, you should join the 5000+ Splunk users in our public Slack Community chat. People ask each other for immediate help on there daily. You can share your question/link to your post there to see if anyone can take a stab at it.

You first have to request access through https://splk.it/slack Fill out the form, and once you receive the approval email from our Community Manager (usually the approval process may take a couple days), you can access Slack.com and ask for help in the #general channel.

0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...