Reporting

Inputlookup cannot perform stats function on field

POR160893
Builder

Hey,

I have an inputlookup and I need to perform a stats values on one of the columns "Migration Comments". So, I am able to use the stats functions on every column EXCEPT the one column I actually need to perform the function on. It seems recognises the field name, even though I am copying the name of the field into the query.

Here is the data table:

POR160893_0-1657108624475.png

 



And here is what the query I am trying to run looks like?

POR160893_1-1657108666877.png

 



What am I doing wrong???


Many thanks,

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Does your field name have trailing blanks, perhaps?

| stats values(Migration*)

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @POR160893,

never use spaces in field names, if you must have spaces, use quotes:

| stats BY "Migration Comments"

Ciao.

Giuseppe

ITWhisperer
SplunkTrust
SplunkTrust

Put column names with embedded spaces in single quotes

| stats values('Migration Comments')

POR160893
Builder

POR160893_0-1657109285162.png

It is really strange as I am able to access other columns like this:

POR160893_1-1657109371316.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does your field name have trailing blanks, perhaps?

| stats values(Migration*)
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...