{"id":3347,"date":"2018-07-26T07:37:32","date_gmt":"2018-07-26T11:37:32","guid":{"rendered":"https:\/\/antipaucity.com\/?p=3347"},"modified":"2018-07-26T07:37:32","modified_gmt":"2018-07-26T11:37:32","slug":"you-cant-disaggregate","status":"publish","type":"post","link":"https:\/\/merikebi.warrenmyers.com\/?p=3347","title":{"rendered":"you can\u2019t disaggregate"},"content":{"rendered":"

Had a customer recently ask about to disaggregate a {{Splunk}} search that had aggregated fields because they export to CSV horribly.<\/p>\n

Here’s the thing.<\/p>\n

You can’t disaggregate aggregated fields.<\/p>\n

And there’s a Good Reason\u2122, too: aggregation<\/a>, by definition, is a one-way street.<\/p>\n

You can’t un-average something.<\/p>\n

Average is an aggregation function.<\/p>\n

So why would you think you could disaggregate any other<\/em> {{Splunk}} aggregation operation (like values or list<\/a>)?<\/p>\n

You can’t.<\/p>\n

And you shouldn’t be able to (as nice as the theoretical use case for it might be).<\/p>\n

So what is a body to do when you have a use case for a clean-to-export report that looks<\/em> as if it had been aggregated, but every field in each row cleanly plunks-out to a single comma-separated value?<\/p>\n

Here’s what I did:<\/h4>\n
{parent search}\n| join {some field that'll exist in the subsearch}\n[ search {parent search}\n | stats {some stats functions here} ]\n| fields - {whatever you don't want}\n| sort - {fieldname}\n<\/pre>\n
What does that end up doing?<\/h4>\n
The subsearch is identical<\/em> to the outer search, plus whatever filtering\/where<\/code>\/|stats you might want\/need to do.<\/p>\n
Using the resultant, filtered set, join<\/a> on a field you know will be unique [enough].<\/p>\n
Then sort<\/code> however you’d like, and remove whatever fields<\/code> you don’t want in the final display.<\/p>\n
\n
Of course, be sure your subsearch<\/a> will complete in under 60 seconds and\/or return fewer than 10,000 lines (unless you’ve modified your {{Splunk}} limits.conf<\/a><\/code>)<\/sub><\/sup><\/p>\n","protected":false},"excerpt":{"rendered":"
Had a customer recently ask about to disaggregate a {{Splunk}} search that had aggregated fields because they export to CSV horribly. Here’s the thing. You can’t disaggregate aggregated fields. And there’s a Good Reason\u2122, too: aggregation, by definition, is a one-way street. You can’t un-average something. Average is an aggregation function. So why would you …
Continue reading you can\u2019t disaggregate<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[23,41],"tags":[76,705,721],"keyring_services":[],"class_list":["post-3347","post","type-post","status-publish","format-standard","hentry","category-insights","category-technical","tag-aggregator","tag-splunk","tag-stats"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/3347","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3347"}],"version-history":[{"count":0,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/3347\/revisions"}],"wp:attachment":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3347"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3347"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3347"},{"taxonomy":"keyring_services","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fkeyring_services&post=3347"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}