About unbelievable_ma

unbelievable_ma · ‎08-27-2020

Unfortunately I can't do that. I don't have a lot of different keys. Around 10-12. I ended up solving this by splitting the key manually into separate columns and then aggregating without using mvexpand. Something like: | fields name, value | eval stages=mvzip(name, value) -- the sort helps here to make sure the keys appear always in the same order | eval stages=mvsort(mvfilter(match(stages, "key-*")) | eval key0=mvindex(stages,0) | rex field=key0 "(?<name>.+),(?<key0>.+)" | eval key1=mvindex(stages,0) | rex field=key1 "(?<name>.+),(?<key1>.+)" -- similarly for all different keys | timechart span=1h median(key1) as key1 median(key2) as key2 -- other keys here This expands to exactly the same amount of data as before but no memory issues.

unbelievable_ma · ‎08-26-2020

No _time is not unique because multiple values exist within the same event (hence mvexpand) hence the results are not correct. I can try to give another example. Lets say I can get this table id mv_field 1 key1,100 key2,200 key3,300 2 key1,100 key2,200 key3,300 3 key1,100 key2,200 key3,300 Given this I want the result: key sum key1 300 key2 600 key3 900 The important part here is that the second column is an mv field. mvexpand breaks the memory usage there so I need some other way to accumulate the results. Maybe I will post this as a separate question cause this is perhaps simpler to explain. Update: mvfilter didn't help with the memory. I found a solution to this that I added here: https://community.splunk.com/t5/Splunk-Search/Accumulate-values-for-a-multi-value-field-by-key/m-p/516577#M145195

Posts	7
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎08-25-2020

Online Status	Offline
Date Last Visited	‎08-27-2020 05:14 PM

Accumulate values for a multi value field by key

mvfilter before using mvexpand to reduce memory us...

Re: Accumulate values for a multi value field by k...

Re: mvfilter before using mvexpand to reduce memor...