Splunk Dev

Issue getting multi-value field to correlate properly

burras
Communicator

I have an existing data set that provides a dump of multiple data points in a single event. The data set looks something like this:

HOSTNAME = "NODE1"
License Type: MAIN INSTALLED.Count: 1 Mainboard: 0 I/O 1: 0 MFP 2: 0 Total Licenses in Use: 0
License Type: TRANSRATE INSTALLED.Count: 12 Mainboard: 0 I/O 1: 0 MFP 2: 0 Total Licenses in Use: 9
License Type: EXTENSION is NOT INSTALLED

And the data set continues with about 50 more license types per node. I've been able to set up extraction of various fields (node, license_type, license_avail, license_used) using props.conf and transforms.conf:

props.conf
[license]
EXTRACT-hostname = HOSTNAME=\"(?<node>\w+)\"
REPORT-license_type = license_type
REPORT-license_available = license_available
REPORT-license_used = license_used

transforms.conf
[license_type]
REGEX = License\sType:\s(?<license_type>\w+)\sINSTALLED\.Count
FORMAT = license_type::$1
MV_ADD = true

[license_available]
REGEX = INSTALLED\.Count\s(?<license_avail>\d+)\s+
FORMAT = license_avail::$1
MV_ADD = true

[license_used]
REGEX = \s+Total\sLicenses\sin\sUse:\s(?<license_used>\d+)
FORMAT = license_used::$1
MV_ADD = true

These seem to be working fine - I'm able to extract and see a list of all of the available licenses on the system (i.e. MAIN, TRANSRATE); the count of all available licenses (i.e. 1, 12), and the count of licenses actually in use (i.e. 0, 9). The problem I'm having is correlating this data together in an actual report for the users. I can't seem to make the numbers line up properly. I've tried numerous stats, charts, and other commands, but can't seem to make it line up into what should be a fairly simple report - For each node, list installed license types with a count of licenses available and licenses in use:

Host Type Available Used
NODE1 MAIN 1 0
NODE1 TRANSRATE 12 9

What I've ended up with is usually the same values for each license type or a completely unordered list with no correlation between the counts and the license type. Some of the searches I've used are:

|stats values(license_type) values(license_avail) values(license_used) by node    - returns uncorrelated list of numbers

|stats latest(license_type) latest(license_avail) latest(license_used) by node        - returns visually what I'm looking for but only 1 license type per node

I'm sure there's something pretty simple that I'm missing here but I appreciate any help...

Tags (1)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try these

Use list function of stats instead of values. The values function gives sorted , unique values of the field hence the non-correlated ordering

your base search
|stats list(license_type) list(license_avail) list(license_used) by node 

OR, make the report linear by expanding multivalued fields.

your base search
| fields node license_type license_avail license_used
| eval temp=mvzip(mvzip(license_type,license_avail,"##"),license_used,"##")
| mvexpand temp 
| rex field=temp "(?<license_type>[^#]+)##(?<license_avail>[^#]+)##(?<license_used>.+)"
| table node license_type license_avail license_used

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try these

Use list function of stats instead of values. The values function gives sorted , unique values of the field hence the non-correlated ordering

your base search
|stats list(license_type) list(license_avail) list(license_used) by node 

OR, make the report linear by expanding multivalued fields.

your base search
| fields node license_type license_avail license_used
| eval temp=mvzip(mvzip(license_type,license_avail,"##"),license_used,"##")
| mvexpand temp 
| rex field=temp "(?<license_type>[^#]+)##(?<license_avail>[^#]+)##(?<license_used>.+)"
| table node license_type license_avail license_used
0 Karma

burras
Communicator

Thanks - using list fixed up the issue. Appreciate the help!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...