topic Re: How to pick multiple value which has same key name in Getting Data In

How to pick multiple value which has same key name

Deprasad — Fri, 03 Jan 2020 10:40:18 GMT

Log looks like this.

{...\"Key_name\":\"Value\",....},
{...\"Key_name\":\"Value\",....},
{...\"Key_name\":\"Value\",....},
{...\"Key_name\":\"Value\",....},

My query now extracting the first field alone. I've created a query which extracts all 4 value using append search with subsequent string from each row but the search takes lots of time since it involves 4 append search.

All i need now is to fetch all 4 value into the column key_name in a single query.

Re: How to pick multiple value which has same key name

richgalloway — Fri, 03 Jan 2020 14:03:22 GMT

Are those separate events or a single event?
Can you share your current query?

Re: How to pick multiple value which has same key name

aberkow — Fri, 03 Jan 2020 19:18:37 GMT

Also if you're using a rex command, you can specify a max_match of 0 to return all matches, see the documentation here: https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Rex

Re: How to pick multiple value which has same key name

niketn — Fri, 03 Jan 2020 19:25:24 GMT

@Deprasad if your data being indexed is JSON format, why dont you try to parse and ingest only the JSON structure and use INDEXED_EXTRACTION=json for getting the fields auto-extracted during index time and leverage tstats to run faster searches?

PS: Parsing data would be required in case your raw data has some additional contents besides JSON or is not actual JSON file. If you are indexing JSON files directly, all you would need to do is to set INDEXED_EXTRACTION=json in the props.conf.

Re: How to pick multiple value which has same key name

groktrev — Wed, 30 Sep 2020 03:35:30 GMT

Try with duplicates:

| stats list(Key_name)

without duplicates:

| stats values(Key_name)

Add a by clause to group by a related field:

| stats values(Key_name) by other_key_name

Re: How to pick multiple value which has same key name

to4kawa — Mon, 06 Jan 2020 08:17:10 GMT

| makeresults
| eval _raw="{\"Key_name\":\"Value\"},
{\"Key_name\":\"Value\"},
{\"Key_name\":\"Value\"},
{\"Key_name\":\"Value\"},"
| rename COMMENT as "this is sample you provided"
| rename COMMENT as "From here, the logic"
| eval _raw=replace(_raw,"^","[")
| eval _raw=replace(_raw,"$","]")
| spath

Hi,@Deprasad
How about this?

Re: How to pick multiple value which has same key name

Deprasad — Thu, 09 Jan 2020 11:59:55 GMT

@aberkow - Thanks a lot..!! It worked like a charm.

Re: How to pick multiple value which has same key name

Deprasad — Thu, 09 Jan 2020 12:00:46 GMT

Thanks for the suggestion @niketnilay !!

Re: How to pick multiple value which has same key name

Deprasad — Thu, 09 Jan 2020 12:02:12 GMT

Thanks @to4kawa !! It worked with max_match command.

Re: How to pick multiple value which has same key name

Deprasad — Thu, 09 Jan 2020 12:02:47 GMT

Thanks @groktrev !! It worked with max_match command.