Splunk Search

How to list multiple fields separately and calculate stats?

efaundez
Path Finder

good afternoon

It is possible to group in a variable the state of multiple fields? Currently I have several fields and each one has to fulfill a condition, but if this happens the state NOK must remain

index = "test" sourcetype = "test2"
| stats
max (field1) as field1,
max (field2) as field2
by _time
| eval var1 = if (field1 <9999, "NOK", var1)
| eval var2 = if (field2 <9999, "NOK", var2)
| fields - _time

In this example the values are shown to me this way and many times the NOK value, which only needs 1

alt text

Does anybody have any suggestions?

0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

Final Answer

..base search
| stats
max (field1) as field1,
max (field2) as field2
by _time
| eval var1 = if (field1 <9999, "NOK", var1)
| eval var2 = if (field2 <9999, "NOK", var2)
| dedup var1 var2
| eval temp=0 | untable temp "N*Var" "NOK Status"
| where 'NOK Status' = "NOK"

View solution in original post

somesoni2
Revered Legend

Try like this

Final Answer

..base search
| stats
max (field1) as field1,
max (field2) as field2
by _time
| eval var1 = if (field1 <9999, "NOK", var1)
| eval var2 = if (field2 <9999, "NOK", var2)
| dedup var1 var2
| eval temp=0 | untable temp "N*Var" "NOK Status"
| where 'NOK Status' = "NOK"

efaundez
Path Finder

Hello

Thank you very much is almost 99% of what I wanted, can you do something similar to this?

| where "NOK Status"! = "OK"

It would only filter the NOK states

Agradesco your answer.

0 Karma

somesoni2
Revered Legend

Yes.. just add | where 'NOK Status'="NOK" to end of above search.

efaundez
Path Finder

gracias por todo

Saludos

0 Karma

somesoni2
Revered Legend

Glad to be of help. If there are no further follow-up question related to this, do remember to accept this answer to close the question.

0 Karma

kiamco
Path Finder

if I am understanding the question right. I believe what you want to look up is the transpose function it turns columns into rows

https://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Transpose

somesoni2
Revered Legend

Is there some portion of query missing? You're referencing field var1 and var2 in your eval expressions (on RHS of 😃 but they don't exist after your stats command.

0 Karma

efaundez
Path Finder

hello, the truth is the query is that but I do not know how to perform the missing part to group the values or make a state dedup and list them

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...