Getting Data In

Converting from multiline field in table of result by stats values() to one line results after geoip... why?

joy76
Path Finder

search 1 :
index=web_access_log
| stats values(src_ip) as web_src_ip, count by dst_ip

search1's results :

web_src_ip dst_ip

123.123.123.123 111.111.111.111
234.234.234.234

345.345.345.345

search 2 :
index=web_access_log
| stats values(src_ip) as web_src_ip, count by dst_ip
| geoip dst_ip

search2's results

web_src_ip dst_ip dst_ip_country_name

123.123.123.123 234.234.234.234 345.345.345.345 111.111.111.111 country_name

After applying geoip command, the result of search2 shows in single-line form.
However, what I really wanted to show is to use geoip to result in multi-line form.
So, any suggestion? How can that be done?

Tags (1)

sideview
SplunkTrust
SplunkTrust

geoip is a python command and I think it can be tricky to get a python command to handle multivalue fields correctly. This might be thus a problem in geoip, but I don't know for sure. At any rate, you can cheat!

use streamstats to paint a row number, use mvexpand to blow out the N x mv fields into N rows of single value fields, wash through geoip, then do stats values by rowIndex to compact it back into your mv form.

index=web_access_log 
| stats values(src_ip) as web_src_ip, count by dst_ip
| streamstats count as rowIndex
| mvexpand web_src_ip
| geoip dst_ip
| stats values(web_src_ip) as web_src_ip values(dst_ip) as dst_ip values(dst_ip_country_name) as dst_ip_country_name by rowIndex

You can strip off the last few pipes and run it pipe by pipe and that'll help you understand how it works.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...