Splunk Search
Highlighted

Expand multivalue field to show subtotals.

New Member

Hi Everyone,

I have a query that produces table 1 below.

| from inputlookup:"incident.csv" | where causedby >= " "
| stats count values(caused
by) by assignment_group

I'd like to make the table more useful by reflecting it as table 2 and 3.

alt text

I tried :
| from inputlookup:"incident.csv" | where causedby >= " "
| stats count values(caused
by) by assignmentgroup
| mvexpand values(caused
by)

but it did not give the desired results.

Any help would be appreciated.

0 Karma
Highlighted

Re: Expand multivalue field to show subtotals.

Ultra Champion
| from inputlookup:"incident.csv" 
| where caused_by >= " "
| stats count by assignment_group caused_by
| stats list(caused_by) as caused_by list(count) as count sum(count) as "total team x team" by assignment_group

View solution in original post

0 Karma
Highlighted

Re: Expand multivalue field to show subtotals.

New Member

Thank you. That works perfectly.

0 Karma