getting the field value after grouping

[rsathish47]

Hi All,

Is possiable to get the field value from raw data after grouing the data by stats?

Thanks
Sathish R

[linu1988]

Hello Sathish,
After you group by stats you will get the _raw data into a multi valued field. In that case you can use some mvfilter function to get the value and mv fuctions to get the count as well. Apart from that if you want to divide the fields use mvexpand then search for the value.

_http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchReference/CommonEvalFunctions

Thanks

[linu1988]

if the DelSize can't be included in the stats in your search you can use append then make another stats to show the DelSize. After your search

|append[|search ...|| eval DelSize=if(Folder="Deleted Items",Size,"")|stats Value(DelSize) as DelSize by user]|stats Values(FolderCount) as FolderCount, Values(DelSize) as DelSize by User

But first try this
..... | eval DelSize=if(Folder="Deleted Items",Size,"") |stats count as FolderCount,Values(DelSize) as DelSize, sum(Size) as TotalSize,sum(Items) as TotalItems by User | table User FolderCount DelSize

[rsathish47]

Thank you Linu, am doing eval and assigning value to variable/Field befor stats command, But am not able to get the value of assigned to field/variable..

Ex: ..... | eval DelSize=if(Folder="Deleted Items",Size,"") |stats count as FolderCount, sum(Size) as TotalSize,sum(Items) as TotalItems by User | table User FolderCount DelSize.
here not able to get Delsize value.