Other Usage

Grouping by two fields the rest fields are missing

Kubousky
Engager

I try to group by 2 fields: policy_id and client_rol but "| stats values(*) by policy_id client_rol " then the rest of fields´ values are missing.

Having following table ...

policy_id client_rol client_id client_city

 001  TO X0001  LONDON
 001  AS X0001 
 001  TO X0001 LONDON
 001  AS X0001 

 

The result I would like to get is:

policy_id client_rol client_id client_city

 001   TO   X0001  LONDON
 001 AS X0001  

 

any clue guys?

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Kubousky,

could you share the full search?

maybe the problem is before stats command, because using "| stats values(*) by policy_id client_rol", you should have all the fields.

only for precision, use:

| stats values(*) AS * BY policy_id client_rol

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Kubousky,

could you share the full search?

maybe the problem is before stats command, because using "| stats values(*) by policy_id client_rol", you should have all the fields.

only for precision, use:

| stats values(*) AS * BY policy_id client_rol

Ciao.

Giuseppe

0 Karma

Kubousky
Engager

that was it. thank u @gcusello 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Kubousky,

good for you, see next time!
Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...