Splunk Search

Help with stats building a wrong result on my table

fpedrosa
Engager

Hello,

I have a lots of records, some one has account_id field filled.. others has org_id field filled, and some ones both filled.... I'm trying to bring the table  both field (account_id and org_id) but, when I put the org_id into the stats by, bring only a few records, If I remove it, bring all the records, whats I'm doing wrong?

Thanks !

 


Here is my search:

 

 

 

| spath 
| rename object.* as *
| spath path=events{} output=events
| mvexpand events 
| stats by timestamp, events, application, event_type, org_id, account_id, context.display_name
| eval _raw=events
| kv
| table created_at_fmt, account_id, "application", "event_type", "context.display_name", title, url, org_id

 

 

 

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| spath 
| rename object.* as *
| spath path=events{} output=events
| mvexpand events 
| fillnull value=0 org_id, account_id
| stats by timestamp, events, application, event_type, org_id, account_id, context.display_name
| eval _raw=events
| kv
| table created_at_fmt, account_id, "application", "event_type", "context.display_name", title, url, org_id
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...