Splunk Search

Is there a way to unbundle a list?

natrixia
Explorer

I'm aggregating some values via 'chart list(value) as jobs by something' and then later on I want to produce a table that puts every value of 'jobs' into a single row. For example my query is

index=main | fields counter, job | dedup job, counter | chart list(job) as jobs by counter

and my output is something like

---------------------
| counter   | job   |
|-------------------|
| counter1  | job11 |
|           | job12 |
|           | job13 |
| ------------------|
| counter2  | job21 |
|           | job22 |
---------------------

and later on I do the following postprocess:

 search counter="counter2" | table jobs

And I get the following response

---------
| job   |
| ------|
| job21 | (row1)
| job22 |
---------

I would like to get this response:

---------
| job   |
|-------|
| job21 | (row1)
|-------|
| job22 | (row2)
---------

I.e. I would like the resulting table to print every value of the 'jobs' list into a separate row of the table but the above command just gives me one row with all the list's values in it. Is there a way to do something like this?

Tags (3)
0 Karma
1 Solution

natrixia
Explorer

Looks like the command I was looking for was mvexpand so it would be something like:

search counter="counter1" | table jobs | mvexpand jobs

View solution in original post

0 Karma

natrixia
Explorer

Looks like the command I was looking for was mvexpand so it would be something like:

search counter="counter1" | table jobs | mvexpand jobs
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

In general, you should avoid the list() function, and just do the original query as:

index=main | stats count by counter, job | fields - count

the fields and dedup are unnecessary and redundant, as chart or stats does that anyway.

natrixia
Explorer

I wanted to do something like you suggested by I need the deduped values of 'counter' to be put into a dropdown menu.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...