Add associated domain to values of dest_ip

[yoshileigh66]

I have a query that gets a list of destination ips per source ip. I also want to add a column for the associated domain name per destination ip. The query I have to get destination ips per source ip is: 

index=network | stats values(dest_ip) by src_ip

I am not wanting to use eval to combine the values of dest_ip and domain into one field, and I tried mvappend but I am unable to achieve the result I want. 

I tried |stats values(dest_ip) values(domain) by src_ip, but the dest_ip and domain columns appear to be independent of each other.

What I am looking for is below: 

src_ip domain_ips domain

I just need the domain name to be "connected" with the domain_ip

[PickleRick · Accepted solution]

Yes. That's how it works - values(whatever) creates just one so-called multivalued field with a list of possible values of given field. The fild is a "standalone being" - if you have two multivalued fields, they are not connected with each other in any way.

You need to either combine both values prior to statsing

| eval destipdomain =dest_ip.":"dest_domain
| stats values(destipdomain) by src_ip

Then if you need  you'll have to split the value by the colon character.

Alternative approach would be to stats by more fields.

| stats values(dest_domain) by src_ip dest_ip

[yoshileigh66]

Thank you so much. I will go forward with splitting on the colon. 

Also want to add that I appreciate when time is taken to explain the 'why' behind commands and why they act the way they do. It definitely helps me learn and retain information. Thanks again.