Splunk Search

Why is values(foo) here?

Communicator

Why is values(Authentication.user_category) here when further down there is "where Authentication.user_category=default"? The where statement would only show results when Authentication.user_category=default, but isn't values(Authentication.user_category) giving a list of all the distinct values of the field "user_category"? So wouldn't there only be one distinct value shown, "default", because that's how the search is filtering it?

| tstats summariesonly max(_time) as _time,values(Authentication.user_category) as user_category,dc(Authentication.dest) as dc(dest) from datamodel=Authentication where Authentication.user_category=default by Authentication.user | drop_dm_object_name("Authentication") | sort 100 - _time | fields _time,user,user_category,dc(dest)

Tags (3)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

That is correct. The creator of the search may wanted to print the value of Authentication.user_category in the result hence he may've added it. It could be replaced by search like this (use an eval to create a static field).

| tstats summariesonly max(_time) as _time,dc(Authentication.dest) as dc(dest) from datamodel=Authentication where Authentication.user_category=default by Authentication.user | drop_dm_object_name("Authentication") | eval user_category="default" | sort 100 - _time | fields _time,user,user_category,dc(dest)

View solution in original post

Champion

You are correct, you will only ever see the user_category with a value of default in the corresponding results. You would get the same result by removing that operator and adding Authentication.user_category to the by clause.

It just carries the filtered value into the results. There are other ways you could do this, this is just one way.

SplunkTrust
SplunkTrust

That is correct. The creator of the search may wanted to print the value of Authentication.user_category in the result hence he may've added it. It could be replaced by search like this (use an eval to create a static field).

| tstats summariesonly max(_time) as _time,dc(Authentication.dest) as dc(dest) from datamodel=Authentication where Authentication.user_category=default by Authentication.user | drop_dm_object_name("Authentication") | eval user_category="default" | sort 100 - _time | fields _time,user,user_category,dc(dest)

View solution in original post