Getting Data In

Converting from multiline field in table of result by stats values() to one line results after geoip... why?

joy76
Path Finder

search 1 :
index=web_access_log
| stats values(src_ip) as web_src_ip, count by dst_ip

search1's results :

web_src_ip dst_ip

123.123.123.123 111.111.111.111
234.234.234.234

345.345.345.345

search 2 :
index=web_access_log
| stats values(src_ip) as web_src_ip, count by dst_ip
| geoip dst_ip

search2's results

web_src_ip dst_ip dst_ip_country_name

123.123.123.123 234.234.234.234 345.345.345.345 111.111.111.111 country_name

After applying geoip command, the result of search2 shows in single-line form.
However, what I really wanted to show is to use geoip to result in multi-line form.
So, any suggestion? How can that be done?

Tags (1)

sideview
SplunkTrust
SplunkTrust

geoip is a python command and I think it can be tricky to get a python command to handle multivalue fields correctly. This might be thus a problem in geoip, but I don't know for sure. At any rate, you can cheat!

use streamstats to paint a row number, use mvexpand to blow out the N x mv fields into N rows of single value fields, wash through geoip, then do stats values by rowIndex to compact it back into your mv form.

index=web_access_log 
| stats values(src_ip) as web_src_ip, count by dst_ip
| streamstats count as rowIndex
| mvexpand web_src_ip
| geoip dst_ip
| stats values(web_src_ip) as web_src_ip values(dst_ip) as dst_ip values(dst_ip_country_name) as dst_ip_country_name by rowIndex

You can strip off the last few pipes and run it pipe by pipe and that'll help you understand how it works.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...