How to display media field

[tahasefiani]

Hi everyone,

I'm trying this search but apparently Splunk doesn't have the same logic as SQl.
Can someone give me help 🙂

| loadjob savedsearch="ifh:myquery" |  where media !="rtc"
|stats dc(media) as lolo by client
|eval nature = if(lolo=2,"all",media) 

When lolo=2 it's okey,but when lolo=1 I can't display my media.

Thanks.

[skoelpin]

If I understand correctly, the output is returning null values in your new field called nature because the lolo value is not 2? If so, easy fix. You lost the media field in line 2 on your stats so using this field on line 3 conditional logic will return null fields, but you also did a dc(media) AS lolo, so you gained a new field called lolo. Change line 3 to this

|eval nature = if(lolo=2,"all",lolo)

[aberkow · Accepted solution]

Your issue is you are trying to display a "media" field which has not been passed through your stats command. stats is a transforming command, meaning it takes all information prior to that pipe and truncates anything not referenced. Since you are not putting

| loadjob savedsearch="ifh:myquery" | where media !="rtc"
|stats dc(media) as lolo, values(media) as media by client
|eval nature = if(lolo=2,"all",media)

media can not be referenced in line 3. Check out the docs here https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Stats and try this out to see if it works.

Also note that this will return a multivalue field for all clients that have more than one media.

[tahasefiani]

It works , Thank you 🙂