multi-value field display

[tmarlette]

I have a search i'm attempting, and I'm trying to find a specific event, and eval the difference, then display that value with a few other fields, in daily buckets. I have most of it done, but this is my first experience dealing with multi value fields, and that's where i'm having my issue.

This is the query:

sourcetype=mysource1 OR sourcetype=mysource2 host=myhost1 OR host=myhost2 startdaysago=7 "sequence gap" | bucket_time span=1day | eval dif=(feed_sequence2-feed_sequence1) | stats sum(dif) by _time,handler,host

The "handler" field has multiple values in it per "host" and I'm attempting to get an output that looks something like [_time,host,handler,count] but I would need the "count" to be per "handler" per "host".

Right now when I run the query, splunk just thinks that there is only one host, and I assume it's because latest event each day is happening on the same host.

Any suggestions are greatly appreciated!!!

[prokopowicz]

I have essentially the same problem. In my case, a "scenario" has multiple "slots", slots have multiple "widgets", and widgets have multiple "assets". I'm trying count the asset ID's per widget / scenario pair. (slots are not relevant in this query)

An input would look like this:

{ 
   \"scenario\": \"webv1\",   
   \"slots\": [
      {  \"name\" : \"slot1\",
         \"widgets\": [  
            {  \"type\": \"A\",
               \"assets\": [ { \"id\": \"d1\" }, 
                                 {  \"id\": \"d2\" } ]  } 
         ]
      },
      {   \"name\" : \"slot2\",
          \"widgets\": [  
           {  \"type\": \"B\",
              \"assets\": [ {  \"id\": \"d3\"} ] }
         ]
      } 
 ]
 }

The single event appears in a table like this:

scenario   widget   asset-id 
webv1      A            d1
           B            d2
                        d3
 

I believe I need to expand the single event into one event per asset, and then count that asset-id by the scenario&widget it appears in. The table for the above event should look like this:

scenario   widget   asset-id 
webv1      A           d1
webv1      A           d2
webv1      B           d3

But mvexpand on the asset-ids gives

webv1    A            d1

         B

webv1    A            d2

         B

webv1    A            d3

         B

The problem is how can you associate A with d1 in one event and d2 in another, and B with d3 in a third?

Here is a bonus I just picked up for working on problems like this. You can put the JSON or text for your event directly into your splunk query without having to first retrieve it from somewhere. This lets you play around with the input very quickly. Just do this:

|stats count | fields -count 
| eval response="
{ 
   YOUR JSON GOES HERE, WITH QUOTES ESCAPED
   \"scenario\": \"webv1\",   
   \"slots\": [
      {  \"name\" : \"slot1\",
         \"widgets\": [  
            {  \"type\": \"A\",
               \"assets\": [ { \"id\": \"d1\" }, 
                                 {  \"id\": \"d2\" } ]  } 
         ]
      },
      {   \"name\" : \"slot2\",
          \"widgets\": [  
           {  \"type\": \"B\",
              \"assets\": [ {  \"id\": \"d3\"} ] }
         ]
      } 
 ]
 }

" 
| spath input=response 
| search YOUR QUERY GOES HERE

[jpass]

What if you break your multi-value fields into individual events with 'mvexpand':

(sourcetype=mysource1 OR sourcetype=mysource2) (host=myhost1 OR host=myhost2) startdaysago=7 "sequence gap" | mvexpand handler | bucket_time span=1day | eval dif=(feed_sequence2-feed_sequence1) | stats sum(dif) by _time,handler,host

[tmarlette]

I didn't copy and paste, but great question!!

[jpass]

ah i see your error does ineed reference handler not hander.

[jpass]

Hmmm. Did you copy and paste my search? I misspelled 'handler' as 'hander'. I corrected it.

[tmarlette]

Nope, no go. Here's the result set:

I also notice that there is an error that pops up when I use mvexpand. Take a look:

This is what happens when I remove the "handler" field: