Splunk Search

Group By optional fields in splunk

adityainamdar89
Explorer

I am trying the following search. EXECUTED, TRANSLATION_UID, DOCUMENT_TYPE are present in the logs but MAP_TYPE and MAP_NAME are not yet added. They will be added later. The search should work without them and MAP_TYPE, MAP_NAME should get added to the group by list once they are in the logs.

...| stats  sum(EXECUTED) as Total_Time, count as Num_of_Executions, avg(EXECUTED) as Avg_exectime, perc80(EXECUTED) as 80th_percentile BY TRANSLATION_UID,DOCUMENT_TYPE, MAP_TYPE*,MAP_NAME* 

I tried the above seeing the following search for adding optional fields as follows:

table Total_Time,Num_of_Executions,MAP_TYPE* MAP_NAME* TRANSLATION_UID DOCUMENT_TYPE

It works. But when I added '*' to fields in group by list it does not work. Thanks for your help in advance!!

Tags (2)
0 Karma

lguinn2
Legend

In the table command, if you list fields that do not exist, the existing fields are still listed.

In the stats command, if you try to group by fields that do not exist, you will get no results.

You need to change your search

...| stats  sum(EXECUTED) as Total_Time, count as Num_of_Executions, avg(EXECUTED) as Avg_exectime, perc80(EXECUTED) as 80th_percentile BY TRANSLATION_UID,DOCUMENT_TYPE

adityainamdar89
Explorer

The following worked for me:

stats values(MAP_TYPE) as MAP_TYPE, values(MAP_NAME) as MAP_NAME, sum(EXECUTED) as Total_Time, count as Num_of_Executions, avg(EXECUTED) as Avg_exectime, perc80(EXECUTED) as 80th_percentile BY TRANSLATION_UID,DOCUMENT_TYPE.

This worked for me only because there is a one to one mapping between the other Group by fields and MAP_TYPE,MAP_NAME. Due to this the values() converted the duplicates to a single value. Else this solution would not have worked.

0 Karma

aweitzman
Motivator

In general, the wildcard represents all the fields that are present. If the field is not present, as in your example, then the wildcard cannot represent it.

That said, I want to understand your question further. When you say you "added '*' to fields in group by list" do you mean your search now ends in the following:

...BY TRANSLATION_UID,DOCUMENT_TYPE,MAP_TYPE,MAP_NAME,*

or did you replace the entire list of field names with just the wildcard?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...