I try to group by 2 fields: policy_id and client_rol but "| stats values(*) by policy_id client_rol " then the rest of fields´ values are missing.
Having following table ...
policy_id client_rol client_id client_city
001 | TO | X0001 | LONDON |
001 | AS | X0001 | |
001 | TO | X0001 | LONDON |
001 | AS | X0001 |
The result I would like to get is:
policy_id client_rol client_id client_city
001 | TO | X0001 | LONDON |
001 | AS | X0001 |
any clue guys?
Hi @Kubousky,
could you share the full search?
maybe the problem is before stats command, because using "| stats values(*) by policy_id client_rol", you should have all the fields.
only for precision, use:
| stats values(*) AS * BY policy_id client_rol
Ciao.
Giuseppe
Hi @Kubousky,
could you share the full search?
maybe the problem is before stats command, because using "| stats values(*) by policy_id client_rol", you should have all the fields.
only for precision, use:
| stats values(*) AS * BY policy_id client_rol
Ciao.
Giuseppe
that was it. thank u @gcusello
Hi @Kubousky,
good for you, see next time!
Ciao and happy splunking.
Giuseppe
P.S.: Karma Points are appreciated 😉