Splunk Search

How to split a multivalue result from stats values() into individual rows?

BrentRiva
Explorer

I'm using stats values(series) to print a list of all the indexes of a specific line of business. Specifically the search is:

<searchTemplate>index="_internal" cost_center=$LOB$ | stats values(series) as "LOB Splunk Indices"</searchTemplate>

I want to be able to click on a specific index in the returned list of indexes, and I want to have it so it does a new search on the given index. However, when I use 'row.<fieldname>' for my drilldown it sends all of the indexes to my form search.

Is there anyway to set it so that it only sends exactly the value the user clicks? Click.value did the same thing for me, but I'd be willing to try it again if you're sure that's how. My thinking is I need to split them up into individual rows, but I'm not sure how.

Thanks!

0 Karma
1 Solution

emiller42
Motivator

Couple things here:

  1. Instead of stats, why not dedup? index="_internal" cost_center=$LOB$ | dedup series | table series | rename series as "LOB Splunk Indices" This will give you one row per value, instead of a single multivalued field.
  2. You can turn a multi-valued field into explicit records with the mvexpand command. index="_internal" cost_center=$LOB$ | stats values(series) as series | mvexpand series | rename series as "LOB Spunk Indices"

View solution in original post

emiller42
Motivator

Couple things here:

  1. Instead of stats, why not dedup? index="_internal" cost_center=$LOB$ | dedup series | table series | rename series as "LOB Splunk Indices" This will give you one row per value, instead of a single multivalued field.
  2. You can turn a multi-valued field into explicit records with the mvexpand command. index="_internal" cost_center=$LOB$ | stats values(series) as series | mvexpand series | rename series as "LOB Spunk Indices"

BrentRiva
Explorer

Wow! That worked perfectly (#1). Thank you so much for the quick reply. That was one of the last things I needed to finish this dashboard.

Get Updates on the Splunk Community!

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...