Splunk Search

Multiple values for table and values unique

Abarny
Path Finder

Hi guys,

Can you help me ? I need to do a table like this

New date available    |      Origine date available
25/06/2017                                  23/05/2017
30/05/2017
16/05/2017

For moment i don't know why but a can't has it with this request :

  index="gta_projets" logs{}.projectId="12903"  |fields logs{}.projectId,logs{}.newDateAvailable 
 |rename logs{}.projectId as "NOVA ID"
 |join [|search index="gtav2_projects" |fields projects{}.dateAvailable, projects{}.id |rename projects{}.id as "NOVA ID"] 
 | table logs{}.newDateAvailable,  projects{}.dateAvailable

And i have this:

New date available    |      Origine date available
    25/06/2017                       23/05/2017          
                                     23/05/2017
    30/05/2017                        23/05/2017
                                      23/05/2017
                                      23/05/2017
    16/05/2017                         23/05/2017

Thanks for your answers

Tags (2)
0 Karma
1 Solution

hardikJsheth
Motivator

Not sure if I understood your question correctly, but you are fetching original date from different index and you want to group by original date ? If that's the case use stats

i.e

 index="gta_projets" logs{}.projectId="12903"  |fields logs{}.projectId,logs{}.newDateAvailable 
  |rename logs{}.projectId as "NOVA ID"
  |join [|search index="gtav2_projects" |fields projects{}.dateAvailable, projects{}.id |rename projects{}.id as "NOVA ID"] 
  | stats  values(logs{}.newDateAvailable) as "New Date Available" by  projects{}.dateAvailable

If this not what you want, check output id with the table and verify why you are getting blank values.

View solution in original post

hardikJsheth
Motivator

Not sure if I understood your question correctly, but you are fetching original date from different index and you want to group by original date ? If that's the case use stats

i.e

 index="gta_projets" logs{}.projectId="12903"  |fields logs{}.projectId,logs{}.newDateAvailable 
  |rename logs{}.projectId as "NOVA ID"
  |join [|search index="gtav2_projects" |fields projects{}.dateAvailable, projects{}.id |rename projects{}.id as "NOVA ID"] 
  | stats  values(logs{}.newDateAvailable) as "New Date Available" by  projects{}.dateAvailable

If this not what you want, check output id with the table and verify why you are getting blank values.

Abarny
Path Finder

Perfect ! thanks very much

0 Karma
Get Updates on the Splunk Community!

Index This | A sphere has three, a circle has two, and a point has zero. What is it?

September 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...