Hi, Splunkers
I have pie chart with simple stats by fullname concatenated with bunit ("John Doe; Marketing",...).
Each user may have several assets linked to him in an asset lookup table.
So in driildown table I need to retrieve all IP addresses (hostnames) for 'klicked' user, e.g.:
| stats count| eval person="John Doe; Marketing" | rex field=person "(?<fullname>[^\;]+)" | lookup asset_lookup fullname as fullname OUTPUT ip host
It only retrieves the first matching result.
How can I get all results?
Like this:
| stats count
| eval person="John Doe; Marketing"
| rex max_match=0 field=person "(?<fullname>[^\;]+)"
| lookup asset_lookup fullname as fullname OUTPUT ip host
| stats values(ip) as ip by fullname
Or this:
| stats count
| eval person="John Doe; Marketing"
| eval fullname = split(person, ";")
| lookup asset_lookup fullname as fullname OUTPUT ip host
| stats values(ip) as ip by fullname
Thanks guys, need to show up what I need - multivalue field ip for my user :
fullname ip
John Doe 10.0.0.1
10.0.0.2
10.0.0.3
Jane Doe 10.4.1.1
10.4.1.3
I don't need bunit part in output
Two things:
That's it! The "Maximum matches" was restricted to 1 (how could I miss this point) , thank you!
Like this:
| stats count
| eval person="John Doe; Marketing"
| rex max_match=0 field=person "(?<fullname>[^\;]+)"
| lookup asset_lookup fullname as fullname OUTPUT ip host
| stats values(ip) as ip by fullname
Or this:
| stats count
| eval person="John Doe; Marketing"
| eval fullname = split(person, ";")
| lookup asset_lookup fullname as fullname OUTPUT ip host
| stats values(ip) as ip by fullname