Splunk Search

Why are values are missing and incorrect when I used stats values() in chart?

Vish
Explorer

I had a tabular chart which has component, basket and age column. But the problem was I had same component with different basket values and different ageing as different rows as shown below, which was duplicating my rows with same component name

Vish_0-1682655222435.png

So, My query was to use to combine the same component as a single row with multiple basket values and display the ageing of each component with respect to the basket,so i used the below code

But the output was this

Vish_2-1682655544854.png

but, it turns out that my values for the combined rows (as a single row) is missing, few are reversed and incorrect can anyone help out please?

by values of that rows what supposed to be this

Vish_1-1682655404765.png

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

When you used stats values() you are getting correct results for the function you are using - your issue is that you are using the wrong function for what you are trying to do. This is because values() puts the unique values in lexicographical order i.e. duplicates are removed as well as the values being sorted. To get the list the way you want, you should use list() instead of values().

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

When you used stats values() you are getting correct results for the function you are using - your issue is that you are using the wrong function for what you are trying to do. This is because values() puts the unique values in lexicographical order i.e. duplicates are removed as well as the values being sorted. To get the list the way you want, you should use list() instead of values().

0 Karma

yuanliu
SplunkTrust
SplunkTrust

It is not fair to ask volunteers to speculate

  1. what data you mean to process.  It's OK to anonymize.  But you must give enough detail to illustrate its characteristics.
  2. what command you use to get the "wrong" result.
  3. what is really "wrong" with that result.  A smudged dot is not an illustration.
  4. what is really expected result.  Again, smudges do not form an illustration.

Oh.  Don't forget, it's best to illustrate data and commands in text, not in screenshots, much less everything smudged screenshot.

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Brett Adams

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative ...

Index This | What can you do to make 55,555 equal 500?

April 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...