Let's say I have the following data that I extracted from JSON into a field called myfield. If I were to print out the values of myfield in a table, for each event, I would have an array of a variable number of key value pairs.  myfield {"K1":"V1","K2":"V2","K3":"V3",....."KN":"VN"} {"A":"X"} {"B":"Y","C":"Z"}   How do I extract only the values (and not the keys) as a new array for each one? The output would look like: my_processed_field ["V1","V2","V3",....."VN"] ["X"] ["Y","Z"]   Help is much appreciated! Thanks! ... View more

I have the following search query that I've been using so far to display the unique values in lists of Ids: <search> | eval ids=if(group_id >= 4, id, '') | eval type_x_ids=if((group_id >= 4 AND is_type_x="true"), id, '') | eval non_type_x_ids=if((group_id >= 4 AND is_type_x="false"), id, '') | stats count as total_count, values(type_x_ids) as list_of_x_ids, values(non_type_x_ids) as list_of_non_x_ids, values(ids) as list_of_all_ids by some_characteristic Now that I've seen which Ids are in the lists, I would like to change the query to count the number of unique ids in the lists split up by some characteristic. mvcount doesn't seem to work in the stats command the way I tried it: attempt 1: | stats count as total_count, mvcount(type_x_ids) as num_of_x_ids, mvcount(non_type_x_ids) as num_of_non_x_ids, mvcount(ids) as num_of_all_ids by some_characteristic attempt 2: | stats count as total_count, mvcount(values(type_x_ids)) as num_of_x_ids, mvcount(values(non_type_x_ids)) as num_of_non_x_ids, mvcount(values(ids)) as num_of_all_ids by some_characteristic How should I write the stats line so I would get a table that shows the number of unique of Ids in each list of Ids split by some characteristic? I would like the following fields in my resulting table: |  some_characteristic  |  total_count  |  num_of_x_ids  |  num_of_non_x_ids  |  num_of_all_ids  |  I would appreciate any help you can give!! ... View more

I have a set of results for the search with id="base_metrics_search" which provide 3 panels with data.  The events each contain a bunch of question metrics and have two fields of note: question_id and is_answered, which I'd like to use to provide data for another 2 panels. An example result set would be: question_id is_answered 1 1 2 0 3 1 4 0 5 0 6 1 7 1 8 1 9 0 10 0 11 1 12 0 13 0 14 1 15 1   How do I find the ids of the first 5 answered and unanswered questions? The first 5 of each type could be in any order. I am hoping to use two tokens to pass these values to other panels using a multivalue or comma separated list. So for the above example, I would end up with something like: answered_ids = 1,3,6,7,8 unanswered_ids = 2,4,5,9,10 I have searched around the doc and I haven't figured out what SPL to use to do this. I am currently using a chained search approach using "head" but this gives me results in the first panel but none in the second:  (I'm using splunk enterprise 8.2.2) <panel> <title>Top Questions</title> <table> <title>Answered Questions</title> <search base="general_metrics_base"> <query>| head limit=5 (is_answered=1) | fields ...</query> </search> <option name="drilldown">none</option> <option name="refresh.display">none</option> </table> <table> <title>Unanswered Questions</title> <search base="general_metrics_base"> <query>| head limit=5 (is_answered=0) | fields ...</query> </search> <option name="drilldown">none</option> <option name="refresh.display">none</option> </table> </panel> I'm looking into passing just the question_Ids on since I need to do further querying in those next two panels anyway.  I assume the answered questions search gets rid of events in the base_metrics_search results preventing the unanswered questions panel search from using them. Should the second panel (for the unanswered questions) of a pair of panels, both in a chained search based off the same original search, get the same original results set to process that the base_metrics_search returned to the first panel? Thanks in advance for any help you could offer! ... View more

I have a data field categ_hierarchy in the format of a series of up to 8 category IDs joined by ">>". For example: categ_id1>>categ_id2>>categ_id3>>...>>categ_id8  Category id 1 is required but category ids 2 through 8 are optional.  Category Ids are strings without the '>' cahracter in them. They might have whitespace that I want to trim from the beginning or end.  Here are 2 examples: simulink/index>>simulink/simulink-environment>>simulink/programmatic-modeling support/parallel-221>>parallel-computing/index I want to lookup each category id and get back the associated category name for each category id and then reconstruct the category names into a similarly formated path:  categ_name1>>categ_name2>>categ_name3>>...>>categ_name8  Here are the two examples constructed from the lookup results Simulink >> Simulink Environment Fundamentals >> Programmatic Model Editing Parallel Computing >> Parallel Computing Toolbox Is there any way to simplify my SPL from this?  | rex field=category_hierarchy "(?<categ_id1>[^>]+)(>>(?<categ_id2>[^>]+))?(>>(?<categ_id3>[^>]+))?(>>(?<categ_id4>[^>]+))?(>>(?<categ_id5>[^>]+))?(>>(?<categ_id6>[^>]+))?(>>(?<categ_id7>[^>]+))?(>>(?<categ_id8>[^>]+))?" | eval categ_id1=trim(categ_id1), categ_id2=trim(categ_id2), categ_id3=trim(categ_id3), categ_id4=trim(categ_id4), categ_id5=trim(categ_id5), categ_id6=trim(categ_id6), categ_id7=trim(categ_id7), categ_id8=trim(categ_id8) | lookup category_lookup category_id AS categ_id1 OUTPUTNEW category_name AS categ_name1 | lookup category_lookup category_id AS categ_id2 OUTPUTNEW category_name AS categ_name2 | lookup category_lookup category_id AS categ_id3 OUTPUTNEW category_name AS categ_name3 | lookup category_lookup category_id AS categ_id4 OUTPUTNEW category_name AS categ_name4 | lookup category_lookup category_id AS categ_id5 OUTPUTNEW category_name AS categ_name5 | lookup category_lookup category_id AS categ_id6 OUTPUTNEW category_name AS categ_name6 | lookup category_lookup category_id AS categ_id7 OUTPUTNEW category_name AS categ_name7 | lookup category_lookup category_id AS categ_id8 OUTPUTNEW category_name AS categ_name8 | eval category_name_hierarchy=categ_name1 | eval category_name_hierarchy=if(isnull(categ_name2), category_name_hierarchy, category_name_hierarchy." >> ".categ_name2) | eval category_name_hierarchy=if(isnull(categ_name3), category_name_hierarchy, category_name_hierarchy." >> ".categ_name3) | eval category_name_hierarchy=if(isnull(categ_name4), category_name_hierarchy, category_name_hierarchy." >> ".categ_name4) | eval category_name_hierarchy=if(isnull(categ_name5), category_name_hierarchy, category_name_hierarchy." >> ".categ_name5) | eval category_name_hierarchy=if(isnull(categ_name6), category_name_hierarchy, category_name_hierarchy." >> ".categ_name6) | eval category_name_hierarchy=if(isnull(categ_name7), category_name_hierarchy, category_name_hierarchy." >> ".categ_name7) | eval category_name_hierarchy=if(isnull(categ_name8), category_name_hierarchy, category_name_hierarchy." >> ".categ_name8) | table category_hierarchy, category_name_hierarchy I know I could split the category_hierachy field by the ">>" delimeter but I don't know how to lookup each of the category Ids in the resulting multivalue field.  Any help would be appreciated!! Thanks, Rena ... View more

Hi, I have a field called "catgories" whose value is in the format of a JSON array. The array is a list of one or more category paths. The paths are in the form of a comma separated list of one or more (category_name:category_id) pairs.   Three example events have the following category data:  "categories":"[{"categ_name_a":"categ_id_a","categ_name_b":"categ_id_b","categ_name_c":"categ_id_c"},{"categ_name_m":"categ_id_m","categ_name_n":"categ_id_n"},{"categ_name_z":"categ_id_z"}]"  "categories":"[{"categ_name_d":"categ_id_d","categ_name_e":"categ_id_e"}]"  "categories":"[{"categ_name_f":"categ_id_f"}]" For each event, I am trying to extract the list of " >> " separated category_ids in each path into a multivalued field. So using the examples above I want to get a list of category paths: event # category_paths 1 "categ_id_a >> categ_id_b >> categ_id_c" "categ_id_m >> categ_id_n" "categ_id_z" 2 "categ_id_d >> categ_id_e" 3 "categ_id_f"   I have no way of knowing what the category names or ids will be or how many (category_name:category_id) pairs there will be in each category path. I also won't know how many category paths are in the categories JSON array. I have tried a bunch of ways to get at the data (spath, json_extract, regex) but I am new to this type of nested extraction. | makeresults | eval categories="[{\"categ_name_a\":\"categ_id_a\",\"categ_name_b\":\"categ_id_b\",\"categ_name_c\":\"categ_id_c\"},{\"categ_name_m\":\"categ_id_m\",\"categ_name_n\":\"categ_id_n\"},{\"categ_name_z\":\"categ_id_z\"}]" | spath input=categories output=category_paths path={} Can anyone help me? Thanks!!!    ... View more

Is it possible to use the value derived from one search and pass it to another search?  For example, I have a search and create a comma separated list of values ids_list: <first search> | stats values(id) as temp_ids | eval ids_list=mvjoin(temp_ids, ",") I'd like to use ids_list in a subsequent search. For example: <first search that returns a list of ids> | stats values(id) as temp_ids | eval ids_list=mvjoin(temp_ids, ",") | search  [ | dbxquery query="SELECT t.id, t.description FROM 'database_name'.'table_name' t WHERE t.id IN (ids_list)" connection="connection_name"]  ... View more