charts - 如何在图表管道后保留 Splunk 中的表字段？尝试将值连接到“over”参数中，但得到“未找到结果”

Question

我有一个搜索，基本上我想显示每个客户每个工作区的用户类型数量，但我只能将客户名称和用户类型输入表中。

这就是我所拥有的：

 | `workspace_submissions((submissions.workspaceGuid=*), (workspaceGuid=*))` 
 | search userGuid=* 
 | eval userPersona=case(workspaceRole="ADMIN", "Builder", cellValueChanges>0 OR modelChanges>0, "Contributor", cellValueChanges=0 AND modelChanges=0, "Viewer") 
 | lookup user-dc5prod userGuid output active 
 | eval US=if(active=1, "Enabled", "Disabled") 
 | stats count by userPersona workspaceGuid 
 | lookup workspace-dc5prod workspaceGuid output workspaceGuid, currentCustomerGuid as customerGuid 
 | lookup customer-dc5prod customerGuid output type name as customerName sfdcAccountGuid
 | chart values(count) over customerName by userPersona

我查看了这个 splunk 论坛问题的回复：https://answers.splunk.com/answers/390709/how-do-i-add-extra-fields-to-a-chart-count-over-fi。 html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev但是当我把

 | eval customerName=customerName."#".workspaceGuid."#".sfdcAccountGuid

在图表之前，我没有返回任何结果。我需要表 customerName sfdcAccountGuid workspaceGuid Builder Contributor and Viewer

Answer 1

我想到了。我的包含 sfdcAccountGuid 的 eval 语句具有空值，并且由于我没有填充空值，因此这些值被完全排除在外。添加一个 | fillnull value=NULL sfdcAccountGuid 允许它正确地通过。