Splunk Search

Expand multivalue field to show subtotals.

jdlocklin526
Observer

Hi Everyone,

I have a query that produces table 1 below.

| from inputlookup:"incident.csv" | where caused_by >= " "
| stats count values(caused_by) by assignment_group

I'd like to make the table more useful by reflecting it as table 2 and 3.

alt text

I tried :
| from inputlookup:"incident.csv" | where caused_by >= " "
| stats count values(caused_by) by assignment_group
| mvexpand values(caused_by)

but it did not give the desired results.

Any help would be appreciated.

0 Karma
1 Solution

to4kawa
Ultra Champion
| from inputlookup:"incident.csv" 
| where caused_by >= " "
| stats count by assignment_group caused_by
| stats list(caused_by) as caused_by list(count) as count sum(count) as "total team x team" by assignment_group

View solution in original post

0 Karma

to4kawa
Ultra Champion
| from inputlookup:"incident.csv" 
| where caused_by >= " "
| stats count by assignment_group caused_by
| stats list(caused_by) as caused_by list(count) as count sum(count) as "total team x team" by assignment_group
0 Karma

jdlocklin526
Observer

Thank you. That works perfectly.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>