Splunk Search

Why stats command return only one specified platform field and not all of them

kacel
New Member
| inputlookup Obso_Inventory.csv | eval Compo=case(Composant="WAF", "LBWAF", Composant="LOAD BALANCER", "LBWAF", Composant="PROXY", "Browsing", Composant="FIREWALL", "Firewall", Composant="GATEWAY SSL", "Remote Access", Composant="GATEWAY SSL VPN", "Remote Access", Composant="IPS", "Anti-Intrusion", Composant="TAP", "Anti-Intrusion")      | rename Compo as Composant | search Composant="Firewall"  Editeur="*" Metier="*" Platform="*" Parent="*"
| stats count  as allFW , dc(Parent) as VSX_Instance
0 Karma

renjith_nair
Legend

@kacel,

Try adding a by clause in your stats

| inputlookup Obso_Inventory.csv 
| eval Compo=case(Composant="WAF", "LBWAF", Composant="LOAD BALANCER", "LBWAF", 
                  Composant="PROXY", "Browsing", Composant="FIREWALL", "Firewall", Composant="GATEWAY SSL", "Remote Access",
                  Composant="GATEWAY SSL VPN", "Remote Access", Composant="IPS", "Anti-Intrusion", 
                  Composant="TAP", "Anti-Intrusion") 
| rename Compo as Composant 
| search Composant="Firewall" Editeur="*" Metier="*" Platform="*" Parent="*"
| stats count as allFW , dc(Parent) as VSX_Instance by Platform
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...