Splunk Search

How to display media field

tahasefiani
Explorer

Hi everyone,

I'm trying this search but apparently Splunk doesn't have the same logic as SQl.
Can someone give me help 🙂

| loadjob savedsearch="ifh:myquery" |  where media !="rtc"
|stats dc(media) as lolo by client
|eval nature = if(lolo=2,"all",media) 

When lolo=2 it's okey,but when lolo=1 I can't display my media.

Thanks.

alt text

0 Karma
1 Solution

aberkow
Builder

Your issue is you are trying to display a "media" field which has not been passed through your stats command. stats is a transforming command, meaning it takes all information prior to that pipe and truncates anything not referenced. Since you are not putting

| loadjob savedsearch="ifh:myquery" | where media !="rtc"
|stats dc(media) as lolo, values(media) as media by client
|eval nature = if(lolo=2,"all",media)

media can not be referenced in line 3. Check out the docs here https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Stats and try this out to see if it works.

Also note that this will return a multivalue field for all clients that have more than one media.

View solution in original post

skoelpin
SplunkTrust
SplunkTrust

If I understand correctly, the output is returning null values in your new field called nature because the lolo value is not 2? If so, easy fix. You lost the media field in line 2 on your stats so using this field on line 3 conditional logic will return null fields, but you also did a dc(media) AS lolo, so you gained a new field called lolo. Change line 3 to this

|eval nature = if(lolo=2,"all",lolo)
0 Karma

aberkow
Builder

Your issue is you are trying to display a "media" field which has not been passed through your stats command. stats is a transforming command, meaning it takes all information prior to that pipe and truncates anything not referenced. Since you are not putting

| loadjob savedsearch="ifh:myquery" | where media !="rtc"
|stats dc(media) as lolo, values(media) as media by client
|eval nature = if(lolo=2,"all",media)

media can not be referenced in line 3. Check out the docs here https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Stats and try this out to see if it works.

Also note that this will return a multivalue field for all clients that have more than one media.

View solution in original post

tahasefiani
Explorer

It works , Thank you 🙂

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!