topic Re: Collecting a list of fields with particular values in Getting Data In

Collecting a list of fields with particular values

Runals — Tue, 15 Apr 2014 00:40:43 GMT

I'm trying to pull the tags associated with my different eventtypes using the following query.

| rest /servicesNS/-/-/configs/conf-tags | dedup eai:appName title

The problem is there is no one field for tags. If there is a tag name it shows up as a field with values of either enabled or disabled. The question is how to pull out the fields and associate it with title field value in this event.

Re: Collecting a list of fields with particular values

yannK — Tue, 15 Apr 2014 01:00:41 GMT

Try that to extract the content of the "title" field then eventtype only

| rest /servicesNS/-/-/configs/conf-tags | dedup eai:appName title | search title="eventtype" | rex field=title "eventtype=(?.*)" | table title eventtype

Re: Collecting a list of fields with particular values

Runals — Tue, 15 Apr 2014 02:33:38 GMT

Thanks for the query yannK. I don't think I explained what I was looking for very well. I was able to work out a solution that I will post below.

Re: Collecting a list of fields with particular values

Runals — Tue, 15 Apr 2014 02:38:30 GMT

There might be an easier way to do this but here is what I came up with. The key to this is specify the search head you are running the query from as you might have an app that has tags/eventtypes that aren't installed on your indexers (note the | search splunk_server= part).

| rest /servicesNS/-/-/configs/conf-tags | search splunk_server=splunk0  | rename eai:appName as app | foreach * [ eval <<FIELD>> = '<<FIELD>>'."##".title."##".app]| stats values(*) as *| transpose | makemv delim=" " "row 1" | mvexpand "row 1"| search "row 1"=enabled* OR "row 1"=disabled*| rex field="row 1" "^(?<status>[^\#]+)##(?<title>[^\#]+)##(?<app>[^\#]+)" | rex field=title ".+\=(?<title>.+)" | rename column as tag | table tag status title app

With that query in hand you can combine that with a REST search for eventtypes and the searches that make them up.

| rest /servicesNS/-/-/configs/conf-eventtypes | search splunk_server=splunk0 | rename eai:appName as app | table app title search | join max=0 app title [| rest /servicesNS/-/-/configs/conf-tags | search splunk_server=splunk0  | rename eai:appName as app | foreach * [ eval <<FIELD>> = '<<FIELD>>'."##".title."##".app]| stats values(*) as *| transpose | makemv delim=" " "row 1" | mvexpand "row 1"| search "row 1"=enabled* OR "row 1"=disabled*| rex field="row 1" "^(?<status>[^\#]+)##(?<title>[^\#]+)##(?<app>[^\#]+)" | rex field=title ".+\=(?<title>.+)" | rename column as tag | table tag status title app] | table app title search tag status | rename title as eventtype | sort app eventtype | stats list(tag) as tags list(status) as status by app eventtype search

I like the readability the stats command gives at the end but you might want to take it off depending on how you use this.

Re: Collecting a list of fields with particular values

dbroggy — Wed, 30 Sep 2020 00:13:50 GMT

don't forget to replace splunk_server=splunk0 with splunk_server=*

Re: Collecting a list of fields with particular values

dbroggy — Wed, 30 Sep 2020 00:23:33 GMT

Re: Collecting a list of fields with particular values

dbroggy — Wed, 08 May 2019 16:27:14 GMT

I found that the above queries are chopping off many of the apps and eventtypes that are associated with the listed tags. Take a look at this shorter part of the query and compare for yourself - eg. the access tags lists eventtypes for several sourcetypes but the app column only lists one of those sourcetypes: