Splunk Search

Why do these searches yield such different results?

csyvenky
Path Finder

index="xyz" "a.b.c.d"=xyz
| chart count by a.b
Yields 232 results.

In order to get field names that are more reasonable, I tried the following:

index="xyz"
| xmlkv
| search a=xyz
| chart count by xyz
| sort - count
Yields only 204 results.

Why does the search with the sub-search truncate results?

Tags (1)
0 Karma

csyvenky
Path Finder

Doh! I saw that last night and was unable to edit my post accordingly. The chart count is irrelevant to the issue. I'm just pointing out how after the xmllv that I have short/useable field names.

a.b.c.d is an XPATH = element1.element1b.element1c.element1d

after the xmlkv I can simply reference d.

What I should have said was:

index="xyz" "a.b.c.d"=xyz
Yields 232 results.

In order to get field names that are more reasonable, I tried the following:

index="xyz"
| xmlkv
| search d=xyz
Yields only 204 results.

0 Karma

dflodstrom
Builder

Is "a.b.c.d" a field and "a.b" another field? In the second search you are saying search for a field, "a", with the value "xyz" and then you're counting by that value, "xyz" again. I think your example isn't reflecting what you're actually doing.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...