Splunk Search

Multiple values for table and values unique

Abarny
Path Finder

Hi guys,

Can you help me ? I need to do a table like this

New date available    |      Origine date available
25/06/2017                                  23/05/2017
30/05/2017
16/05/2017

For moment i don't know why but a can't has it with this request :

  index="gta_projets" logs{}.projectId="12903"  |fields logs{}.projectId,logs{}.newDateAvailable 
 |rename logs{}.projectId as "NOVA ID"
 |join [|search index="gtav2_projects" |fields projects{}.dateAvailable, projects{}.id |rename projects{}.id as "NOVA ID"] 
 | table logs{}.newDateAvailable,  projects{}.dateAvailable

And i have this:

New date available    |      Origine date available
    25/06/2017                       23/05/2017          
                                     23/05/2017
    30/05/2017                        23/05/2017
                                      23/05/2017
                                      23/05/2017
    16/05/2017                         23/05/2017

Thanks for your answers

Tags (2)
0 Karma
1 Solution

hardikJsheth
Motivator

Not sure if I understood your question correctly, but you are fetching original date from different index and you want to group by original date ? If that's the case use stats

i.e

 index="gta_projets" logs{}.projectId="12903"  |fields logs{}.projectId,logs{}.newDateAvailable 
  |rename logs{}.projectId as "NOVA ID"
  |join [|search index="gtav2_projects" |fields projects{}.dateAvailable, projects{}.id |rename projects{}.id as "NOVA ID"] 
  | stats  values(logs{}.newDateAvailable) as "New Date Available" by  projects{}.dateAvailable

If this not what you want, check output id with the table and verify why you are getting blank values.

View solution in original post

hardikJsheth
Motivator

Not sure if I understood your question correctly, but you are fetching original date from different index and you want to group by original date ? If that's the case use stats

i.e

 index="gta_projets" logs{}.projectId="12903"  |fields logs{}.projectId,logs{}.newDateAvailable 
  |rename logs{}.projectId as "NOVA ID"
  |join [|search index="gtav2_projects" |fields projects{}.dateAvailable, projects{}.id |rename projects{}.id as "NOVA ID"] 
  | stats  values(logs{}.newDateAvailable) as "New Date Available" by  projects{}.dateAvailable

If this not what you want, check output id with the table and verify why you are getting blank values.

Abarny
Path Finder

Perfect ! thanks very much

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...