Splunk Search

Why are values are missing and incorrect when I used stats values() in chart?

Vish
Explorer

I had a tabular chart which has component, basket and age column. But the problem was I had same component with different basket values and different ageing as different rows as shown below, which was duplicating my rows with same component name

Vish_0-1682655222435.png

So, My query was to use to combine the same component as a single row with multiple basket values and display the ageing of each component with respect to the basket,so i used the below code

But the output was this

Vish_2-1682655544854.png

but, it turns out that my values for the combined rows (as a single row) is missing, few are reversed and incorrect can anyone help out please?

by values of that rows what supposed to be this

Vish_1-1682655404765.png

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

When you used stats values() you are getting correct results for the function you are using - your issue is that you are using the wrong function for what you are trying to do. This is because values() puts the unique values in lexicographical order i.e. duplicates are removed as well as the values being sorted. To get the list the way you want, you should use list() instead of values().

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

When you used stats values() you are getting correct results for the function you are using - your issue is that you are using the wrong function for what you are trying to do. This is because values() puts the unique values in lexicographical order i.e. duplicates are removed as well as the values being sorted. To get the list the way you want, you should use list() instead of values().

0 Karma

yuanliu
SplunkTrust
SplunkTrust

It is not fair to ask volunteers to speculate

  1. what data you mean to process.  It's OK to anonymize.  But you must give enough detail to illustrate its characteristics.
  2. what command you use to get the "wrong" result.
  3. what is really "wrong" with that result.  A smudged dot is not an illustration.
  4. what is really expected result.  Again, smudges do not form an illustration.

Oh.  Don't forget, it's best to illustrate data and commands in text, not in screenshots, much less everything smudged screenshot.

0 Karma
Get Updates on the Splunk Community!

Enter the Dashboard Challenge and Watch the .conf24 Global Broadcast!

The Splunk Community Dashboard Challenge is still happening, and it's not too late to enter for the week of ...

Join Us at the Builder Bar at .conf24 – Empowering Innovation and Collaboration

What is the Builder Bar? The Builder Bar is more than just a place; it's a hub of creativity, collaboration, ...

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...