Splunk Search

Manipulating data in a Values() output

New Member

Is there any sort of syntax for me to be able to manipulate or get data on data that exists in the Values() field.

So lets say that I do a

| stats values(dest_port) by src_ip

I then want to order the values in the values(dest_port), or I only want the top 10 of the list in values(), or I want to only get the top and bottom. Is there any sort of notation or syntax that I can use to do this?

0 Karma

Splunk Employee
Splunk Employee

Once you use values(), your fields become multi-value. There are numerous functions that can be applied to these sorts of fields, check out https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/MultivalueEvalFunctions

If you want to sort the data, use eval sorted=mvsort(data). If you want the first 10 events, you can use eval first10 = mvindex(data,0,9)

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...