Splunk Search

Expand multivalue field to show subtotals.

jdlocklin526
Observer

Hi Everyone,

I have a query that produces table 1 below.

| from inputlookup:"incident.csv" | where caused_by >= " "
| stats count values(caused_by) by assignment_group

I'd like to make the table more useful by reflecting it as table 2 and 3.

alt text

I tried :
| from inputlookup:"incident.csv" | where caused_by >= " "
| stats count values(caused_by) by assignment_group
| mvexpand values(caused_by)

but it did not give the desired results.

Any help would be appreciated.

0 Karma
1 Solution

to4kawa
SplunkTrust
SplunkTrust
| from inputlookup:"incident.csv" 
| where caused_by >= " "
| stats count by assignment_group caused_by
| stats list(caused_by) as caused_by list(count) as count sum(count) as "total team x team" by assignment_group

View solution in original post

0 Karma

to4kawa
SplunkTrust
SplunkTrust
| from inputlookup:"incident.csv" 
| where caused_by >= " "
| stats count by assignment_group caused_by
| stats list(caused_by) as caused_by list(count) as count sum(count) as "total team x team" by assignment_group

View solution in original post

0 Karma

jdlocklin526
Observer

Thank you. That works perfectly.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!