Other Usage

Grouping by two fields the rest fields are missing

Kubousky
Engager

I try to group by 2 fields: policy_id and client_rol but "| stats values(*) by policy_id client_rol " then the rest of fields´ values are missing.

Having following table ...

policy_id client_rol client_id client_city

 001  TO X0001  LONDON
 001  AS X0001 
 001  TO X0001 LONDON
 001  AS X0001 

 

The result I would like to get is:

policy_id client_rol client_id client_city

 001   TO   X0001  LONDON
 001 AS X0001  

 

any clue guys?

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Kubousky,

could you share the full search?

maybe the problem is before stats command, because using "| stats values(*) by policy_id client_rol", you should have all the fields.

only for precision, use:

| stats values(*) AS * BY policy_id client_rol

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Kubousky,

could you share the full search?

maybe the problem is before stats command, because using "| stats values(*) by policy_id client_rol", you should have all the fields.

only for precision, use:

| stats values(*) AS * BY policy_id client_rol

Ciao.

Giuseppe

0 Karma

Kubousky
Engager

that was it. thank u @gcusello 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Kubousky,

good for you, see next time!
Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...