Grouping by two fields the rest fields are missing

[Kubousky]

I try to group by 2 fields: policy_id and client_rol but "| stats values(*) by policy_id client_rol " then the rest of fields´ values are missing.

Having following table ...

policy_id client_rol client_id client_city

001	TO	X0001	LONDON
001	AS	X0001
001	TO	X0001	LONDON
001	AS	X0001

The result I would like to get is:

policy_id client_rol client_id client_city

001	TO	X0001	LONDON
001	AS	X0001

any clue guys?

[gcusello · Accepted solution]

Hi @Kubousky,

could you share the full search?

maybe the problem is before stats command, because using "| stats values(*) by policy_id client_rol", you should have all the fields.

only for precision, use:

| stats values(*) AS * BY policy_id client_rol

Ciao.

Giuseppe

[Kubousky]

that was it. thank u @gcusello 

[gcusello]

Hi @Kubousky,

good for you, see next time!
Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉