Splunk Search

mvexpand is not trimming values

dspracklen
Path Finder

As per my question yesterday, I thought I had all of my problems resolved. I since discovered that when I do mvexpand on the raw data it does not break out the individual values.

Restating the problem from before, I need to group events together and eliminate transactions, and then perform stat functions on the remainder. The suggestions I've seen are to add the mvraw=t option to the transaction command before doing mvexpand.

If I had 42 values in a field called ProblemID from 42 events originally, I would end up with a copy of all 42 values in each of the new events created by mvexpand. I need to either find a way to break the transaction out into the original events or at least just be able to perform stat calls on the raw data as though they were the original events.

Hope that makes sense.

EDIT Nevermind. I see now that the transaction command is NOT going to be useful to me in this instance. The problem is that for each event for a given asset there is a value associated with it. I need to sum those values up, but transaction will combine like values and thus give me a wrong answer when I act on the compressed information. I will probably just have to just have a very long-running search and deal with it. (this is a scheduled search anyway)

Tags (2)
0 Karma
1 Solution

dspracklen
Path Finder

Please see the edit section in the question. I realized this whole method is flawed anyway, so the question has become irrelevant. Sorry.

View solution in original post

0 Karma

dspracklen
Path Finder

Please see the edit section in the question. I realized this whole method is flawed anyway, so the question has become irrelevant. Sorry.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...