Splunk Search

Changes in `values` function from 8.x version

piefragnisp
Explorer

Hi,

we are testing a 8.* of Splunk version using a docker image on a POC virtual machine to migrate our 7.3.4 dev cluster.

We've noticed there is a change in values function in tstats command:

  • 7.3.4 version the values function can have no inputs params
  • 8.x version the values() function must have an input param

so - for example - for a query like this:

| tstats values where index=our_index by fieldA, fieldB | rename fieldA as A, fieldB as B| where like(A,"%some_criteria%") OR like(A,"%some_criteria%") | dedup A | dedup B

we have some difficults understanding the equivalent search in a 8.x Splunk. We tried a query like this one:

| tstats values(fieldA), values(fieldB) where index=our_index by fieldA, fieldB | rename fieldA as A, fieldB as B| where like(A,"%some_criteria%") OR like(A,"%some_criteria%") | dedup A | dedup B

but we don't know if it's the right way because in the output we have two more columns:

  • values(A)
  • values(B)

with the same values of columns A and B. Do you have any suggest for this particular case or any docs in order to study these changes?

Thanks a lot.

0 Karma

to4kawa
Ultra Champion
0 Karma

piefragnisp
Explorer

@to4kawa thanks. We saw the doc and probably we missed something: can you show us the point in the doc answering our question?

We don't understand how to refactor our query in order to be 8.x compatible.

Thanks

0 Karma

to4kawa
Ultra Champion

both example #9 is easy to understand.

| tstats values(fieldA) as A, values(fieldB) as B where index=our_index  | where like(A,"%some_criteria%") OR like(A,"%some_criteria%") 

your query is like above.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...