Splunk Search

field combination does not work properly

can_surer
New Member

Hi,
I have the following search on splunk indexer.
Although field "a" and "b" return results, field "steps" does not return stable results.(only one or zero result is returned).
thanks

sourcetype="F5:iRule:WebAccess"|sort -req_elapsed_time|head 3|stats count by url client_address req_elapsed_time server_name|stats sum(count) as count list(url) as a list(server_name) as b by server_name | eval steps=b."-".a| fields steps count

Tags (2)
0 Karma
1 Solution

pedromvieira
Communicator

You can use mvexpand before your field concatenation.

  • mvexpand
    http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Mvexpand

    sourcetype="F5:iRule:WebAccess"| head 100000 | sort -req_elapsed_time|head 3|stats count by url client_address req_elapsed_time server_name|stats sum(count) as count list(url) as a list(server_name) as b by server_name | mvexpand a | mvexpand b | eval steps=b."-".a | fields steps count

View solution in original post

pedromvieira
Communicator

You can use mvexpand before your field concatenation.

  • mvexpand
    http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Mvexpand

    sourcetype="F5:iRule:WebAccess"| head 100000 | sort -req_elapsed_time|head 3|stats count by url client_address req_elapsed_time server_name|stats sum(count) as count list(url) as a list(server_name) as b by server_name | mvexpand a | mvexpand b | eval steps=b."-".a | fields steps count

can_surer
New Member

Thanks for your recommendation.
It solved my issue.

0 Karma

Ayn
Legend

eval won't like doing string concatenations on multivalued fields. It does that on single-valued fields only.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...