Splunk Search

using 'values' in stats shows values merged

beriwalnishant
Path Finder

Hello Experts,

 

I was wondering if you can help me figure out how do I show the merged values in a field as 'unmerged' when use 'values' in stats command

beriwalnishant_0-1700457913149.png

 

(DETAILS_SVC_ERROR) and (FARE/PRCNG/AVL-MULT. RSNS) are different values .... coming as merged as an example, its merging all values in one when used "Values" OR "List" how to unmerge same

If I use 'mvexpand' it then expands to single count even if the values are same

 

Thanks in advance

Nishant

Labels (3)
Tags (3)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Well, this is how it's supposed to work. list() or values() gives you a multivalued field with a list of values.

If you need something else, you need to do something else.

0 Karma

beriwalnishant
Path Finder

But then I dont get the individual Totals if I do that along with the message.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Perhaps it would be better for you to show what it is that you do want?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You are correct, mvexpand of a values() or list() field will duplicate the event. If you want to count by ErrorCode separately, include ErrorCode in your by clause of the stats command.

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...