Reporting

Inputlookup cannot perform stats function on field

POR160893
Builder

Hey,

I have an inputlookup and I need to perform a stats values on one of the columns "Migration Comments". So, I am able to use the stats functions on every column EXCEPT the one column I actually need to perform the function on. It seems recognises the field name, even though I am copying the name of the field into the query.

Here is the data table:

POR160893_0-1657108624475.png

 



And here is what the query I am trying to run looks like?

POR160893_1-1657108666877.png

 



What am I doing wrong???


Many thanks,

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Does your field name have trailing blanks, perhaps?

| stats values(Migration*)

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @POR160893,

never use spaces in field names, if you must have spaces, use quotes:

| stats BY "Migration Comments"

Ciao.

Giuseppe

ITWhisperer
SplunkTrust
SplunkTrust

Put column names with embedded spaces in single quotes

| stats values('Migration Comments')

POR160893
Builder

POR160893_0-1657109285162.png

It is really strange as I am able to access other columns like this:

POR160893_1-1657109371316.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does your field name have trailing blanks, perhaps?

| stats values(Migration*)
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...