Splunk Search

How to display media field

tahasefiani
Explorer

Hi everyone,

I'm trying this search but apparently Splunk doesn't have the same logic as SQl.
Can someone give me help 🙂

| loadjob savedsearch="ifh:myquery" |  where media !="rtc"
|stats dc(media) as lolo by client
|eval nature = if(lolo=2,"all",media) 

When lolo=2 it's okey,but when lolo=1 I can't display my media.

Thanks.

alt text

0 Karma
1 Solution

aberkow
Builder

Your issue is you are trying to display a "media" field which has not been passed through your stats command. stats is a transforming command, meaning it takes all information prior to that pipe and truncates anything not referenced. Since you are not putting

| loadjob savedsearch="ifh:myquery" | where media !="rtc"
|stats dc(media) as lolo, values(media) as media by client
|eval nature = if(lolo=2,"all",media)

media can not be referenced in line 3. Check out the docs here https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Stats and try this out to see if it works.

Also note that this will return a multivalue field for all clients that have more than one media.

View solution in original post

skoelpin
SplunkTrust
SplunkTrust

If I understand correctly, the output is returning null values in your new field called nature because the lolo value is not 2? If so, easy fix. You lost the media field in line 2 on your stats so using this field on line 3 conditional logic will return null fields, but you also did a dc(media) AS lolo, so you gained a new field called lolo. Change line 3 to this

|eval nature = if(lolo=2,"all",lolo)
0 Karma

aberkow
Builder

Your issue is you are trying to display a "media" field which has not been passed through your stats command. stats is a transforming command, meaning it takes all information prior to that pipe and truncates anything not referenced. Since you are not putting

| loadjob savedsearch="ifh:myquery" | where media !="rtc"
|stats dc(media) as lolo, values(media) as media by client
|eval nature = if(lolo=2,"all",media)

media can not be referenced in line 3. Check out the docs here https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Stats and try this out to see if it works.

Also note that this will return a multivalue field for all clients that have more than one media.

tahasefiani
Explorer

It works , Thank you 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...