Splunk Search

Expand multivalue field to show subtotals.

jdlocklin526
Observer

Hi Everyone,

I have a query that produces table 1 below.

| from inputlookup:"incident.csv" | where caused_by >= " "
| stats count values(caused_by) by assignment_group

I'd like to make the table more useful by reflecting it as table 2 and 3.

alt text

I tried :
| from inputlookup:"incident.csv" | where caused_by >= " "
| stats count values(caused_by) by assignment_group
| mvexpand values(caused_by)

but it did not give the desired results.

Any help would be appreciated.

0 Karma
1 Solution

to4kawa
Ultra Champion
| from inputlookup:"incident.csv" 
| where caused_by >= " "
| stats count by assignment_group caused_by
| stats list(caused_by) as caused_by list(count) as count sum(count) as "total team x team" by assignment_group

View solution in original post

0 Karma

to4kawa
Ultra Champion
| from inputlookup:"incident.csv" 
| where caused_by >= " "
| stats count by assignment_group caused_by
| stats list(caused_by) as caused_by list(count) as count sum(count) as "total team x team" by assignment_group
0 Karma

jdlocklin526
Observer

Thank you. That works perfectly.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...