Splunk Search

How to display media field

tahasefiani
Explorer

Hi everyone,

I'm trying this search but apparently Splunk doesn't have the same logic as SQl.
Can someone give me help 🙂

| loadjob savedsearch="ifh:myquery" |  where media !="rtc"
|stats dc(media) as lolo by client
|eval nature = if(lolo=2,"all",media) 

When lolo=2 it's okey,but when lolo=1 I can't display my media.

Thanks.

alt text

0 Karma
1 Solution

aberkow
Builder

Your issue is you are trying to display a "media" field which has not been passed through your stats command. stats is a transforming command, meaning it takes all information prior to that pipe and truncates anything not referenced. Since you are not putting

| loadjob savedsearch="ifh:myquery" | where media !="rtc"
|stats dc(media) as lolo, values(media) as media by client
|eval nature = if(lolo=2,"all",media)

media can not be referenced in line 3. Check out the docs here https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Stats and try this out to see if it works.

Also note that this will return a multivalue field for all clients that have more than one media.

View solution in original post

skoelpin
SplunkTrust
SplunkTrust

If I understand correctly, the output is returning null values in your new field called nature because the lolo value is not 2? If so, easy fix. You lost the media field in line 2 on your stats so using this field on line 3 conditional logic will return null fields, but you also did a dc(media) AS lolo, so you gained a new field called lolo. Change line 3 to this

|eval nature = if(lolo=2,"all",lolo)
0 Karma

aberkow
Builder

Your issue is you are trying to display a "media" field which has not been passed through your stats command. stats is a transforming command, meaning it takes all information prior to that pipe and truncates anything not referenced. Since you are not putting

| loadjob savedsearch="ifh:myquery" | where media !="rtc"
|stats dc(media) as lolo, values(media) as media by client
|eval nature = if(lolo=2,"all",media)

media can not be referenced in line 3. Check out the docs here https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Stats and try this out to see if it works.

Also note that this will return a multivalue field for all clients that have more than one media.

tahasefiani
Explorer

It works , Thank you 🙂

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...