About akshaysaraf

akshaysaraf · ‎09-21-2020

Thank you so much. It worked! I made a minor change, from : | streamstats count as session to: | streamstats count as session by ID I appreciate your help very much. 🙂

akshaysaraf · ‎09-21-2020

You helped me in past with question : https://community.splunk.com/t5/Splunk-Search/Self-Join-and-override-Values/m-p/512453 In this question the only difference is there is a MV field as well. I need the MV field of the latest() record. Coalesce doesn't seem to work for it.

akshaysaraf · ‎09-21-2020

Sorry, I dont understand. My current query to display those 2 JSON events is "index=abc" that's it. The expected output I mentioned is a new implementation and I am seeking help for that. I haven't given any karma points, I just like the answer that has worked for me in past questions. No karma given for this topic.

akshaysaraf · ‎09-21-2020

Hello, Thank you for your response, This would return all 4 nested records. I dont need those. I need only 2, which are overridden by the later record. I added some explanation in the question, and an expected output.

akshaysaraf · ‎09-21-2020

Need some help with a search { "id": "123", "start_time": "2020-08-01 15:00:00", "end_time": "2020-08-01 16:00:00", "status": "FAIL", "details": [ { "sub_id": 1, "status": "PASS" }, { "sub_id": 2, "status": "FAIL" } ] } { "id": "124", "start_time": "2020-08-01 16:05:00", "end_time": "2020-08-01 16:30:00", "status": "PASS", "original_id": "123", "details": [ { "sub_id": 1, "status": "PASS" }, { "sub_id": 3, "status": "PASS" } ] } These two events can be joined with id and original_id field. The output below shows data from id:123 but overrides some fields like, end_time, status, sub_id and sub_status from second event. The Tabular output I expect is : id start_time end_time status sub_id sub_status 123 2020-08-01 15:00:00 2020-08-01 16:30:00 PASS 1 PASS 123 2020-08-01 15:00:00 2020-08-01 16:30:00 PASS 3 PASS Any help is appreciated, thanks

akshaysaraf · ‎08-04-2020

That works, Thank you so much.

akshaysaraf · ‎08-04-2020

Need some help with a query Sample Data: { id: “123”, start_time: “2020-08-01 15:00:00”, end_time: “2020-08-01 16:00:00”, status: “FAIL” } { id: “124”, start_time: “2020-08-01 16:05:00”, end_time: “2020-08-01 16:30:00”, status: “SUCCESS”, original_id: “123” } Expected output (in table format) should only have 1 record: id start_time end_time status 123 2020-08-01 15:00:00 2020-08-01 16:30:00 SUCCESS This event shows data from id=123, but overrides some field like end_time and Status from latter event. Goal : When we have data where id=original_id then we override some fields from latter event to former event.

akshaysaraf · ‎03-03-2020

Actually I didn't add double quotes while asking this question, the data in production server does have it. I was trying it with stats, but wasn't giving expected result. Thank You for you help.

akshaysaraf · ‎03-02-2020

Thank you, but in my production server I have about 500,000 events which means 500,000 parent ID's, and each parent has about 200 child records. When I mvexpand for such fields I run out of memory and the search truncates my result. Is there a way of doing it without mvexpand?

akshaysaraf · ‎03-02-2020

My data looks like: { parent_id: 1 child_info: [ { id: 123, status: "PASS" }, { id: 456, status: "FAIL" } ] } I am trying to print the result in format: parent ID | Child_Passed_count | Child_Failed_count 1 1 1

Posts	10
Solutions	0
Karma Given	3
Karma Received	1
Member Since	‎04-12-2019

Online Status	Offline
Date Last Visited	‎09-22-2020 12:39 PM

Self join and override MV fields

Self Join and override Values

How can I count mv fields by type?

Re: Self join and override MV fields

Re: Self join and override MV fields

Re: Self join and override MV fields

Re: Self join and override MV fields

Self join and override MV fields

Re: Self Join and override Values

Self Join and override Values

Re: How can I count mv fields by type?

Re: How can I count mv fields by type?

How can I count mv fields by type?

Join the Conversation