Reporting

Inputlookup cannot perform stats function on field

POR160893
Builder

Hey,

I have an inputlookup and I need to perform a stats values on one of the columns "Migration Comments". So, I am able to use the stats functions on every column EXCEPT the one column I actually need to perform the function on. It seems recognises the field name, even though I am copying the name of the field into the query.

Here is the data table:

POR160893_0-1657108624475.png

 



And here is what the query I am trying to run looks like?

POR160893_1-1657108666877.png

 



What am I doing wrong???


Many thanks,

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Does your field name have trailing blanks, perhaps?

| stats values(Migration*)

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @POR160893,

never use spaces in field names, if you must have spaces, use quotes:

| stats BY "Migration Comments"

Ciao.

Giuseppe

ITWhisperer
SplunkTrust
SplunkTrust

Put column names with embedded spaces in single quotes

| stats values('Migration Comments')

POR160893
Builder

POR160893_0-1657109285162.png

It is really strange as I am able to access other columns like this:

POR160893_1-1657109371316.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does your field name have trailing blanks, perhaps?

| stats values(Migration*)
Get Updates on the Splunk Community!

Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...

Hi friends!    At Splunk, your product success is our top priority. With Enterprise Security (ES), we're here ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...