Getting Data In

What does the 'groupby_rank: "0" ' property in 'fields' member of job result response mean ?

thepainfull
Explorer

Hello,

If I hit the url : services/search/jobs/[job id]/results in the API, I get a response like :

{
  "preview": false,
  "init_offset": 0,
  "messages": [],
  "fields": [
    {
      "name": "Field1",
      "groupby_rank": "0"
    },
    {
      "name": "Field2"
    }
  ],
  "results": [
    {
      "Field1": "some_value_1",
      "Field2": "some_value_2"
    },
    {
      "Field1": "some_value_3",
      "Field2": "some_value_4"
    },
    {
      "Field1": "some_value_5",
      "Field2": "some_value_6"
    }
  ],
  "highlighted": {}
}

In that response, what does the "groupby_rank: 0" property mean ? I couldn't find any explanation in the API doc (I can't post links) as it only details the GET parameters.

Thank you !

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

This turns out to be the "by clause" if you're running a stats command with a by clause.

| timechart count is like a | stats count by _time and therefore the groupby_rank 0 would be equal to _time

I believe it would look like this:

<fieldOrder>
<field groupby_rank="0">_time</field>
<field groupby_rank="1">fieldname</field>
</fieldOrder>

If you did | stats count by _time fieldname. For example.

View solution in original post

0 Karma

jkat54
SplunkTrust
SplunkTrust

This turns out to be the "by clause" if you're running a stats command with a by clause.

| timechart count is like a | stats count by _time and therefore the groupby_rank 0 would be equal to _time

I believe it would look like this:

<fieldOrder>
<field groupby_rank="0">_time</field>
<field groupby_rank="1">fieldname</field>
</fieldOrder>

If you did | stats count by _time fieldname. For example.

0 Karma

thepainfull
Explorer

Ooooh ok I see, thank you !

jkat54
SplunkTrust
SplunkTrust

You're very welcome!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...