Splunk Search

Multiple values for table and values unique

Abarny
Path Finder

Hi guys,

Can you help me ? I need to do a table like this

New date available    |      Origine date available
25/06/2017                                  23/05/2017
30/05/2017
16/05/2017

For moment i don't know why but a can't has it with this request :

  index="gta_projets" logs{}.projectId="12903"  |fields logs{}.projectId,logs{}.newDateAvailable 
 |rename logs{}.projectId as "NOVA ID"
 |join [|search index="gtav2_projects" |fields projects{}.dateAvailable, projects{}.id |rename projects{}.id as "NOVA ID"] 
 | table logs{}.newDateAvailable,  projects{}.dateAvailable

And i have this:

New date available    |      Origine date available
    25/06/2017                       23/05/2017          
                                     23/05/2017
    30/05/2017                        23/05/2017
                                      23/05/2017
                                      23/05/2017
    16/05/2017                         23/05/2017

Thanks for your answers

Tags (2)
0 Karma
1 Solution

hardikJsheth
Motivator

Not sure if I understood your question correctly, but you are fetching original date from different index and you want to group by original date ? If that's the case use stats

i.e

 index="gta_projets" logs{}.projectId="12903"  |fields logs{}.projectId,logs{}.newDateAvailable 
  |rename logs{}.projectId as "NOVA ID"
  |join [|search index="gtav2_projects" |fields projects{}.dateAvailable, projects{}.id |rename projects{}.id as "NOVA ID"] 
  | stats  values(logs{}.newDateAvailable) as "New Date Available" by  projects{}.dateAvailable

If this not what you want, check output id with the table and verify why you are getting blank values.

View solution in original post

hardikJsheth
Motivator

Not sure if I understood your question correctly, but you are fetching original date from different index and you want to group by original date ? If that's the case use stats

i.e

 index="gta_projets" logs{}.projectId="12903"  |fields logs{}.projectId,logs{}.newDateAvailable 
  |rename logs{}.projectId as "NOVA ID"
  |join [|search index="gtav2_projects" |fields projects{}.dateAvailable, projects{}.id |rename projects{}.id as "NOVA ID"] 
  | stats  values(logs{}.newDateAvailable) as "New Date Available" by  projects{}.dateAvailable

If this not what you want, check output id with the table and verify why you are getting blank values.

Abarny
Path Finder

Perfect ! thanks very much

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...