topic Re: Need help with Splunk query in Dashboards & Visualizations

Need help with Splunk query

Mrig342 — Thu, 28 Jan 2021 04:25:29 GMT

Hi,

I have created the below table using the query "index=main host="abcde" | rex field=_raw "(?ms)Label\s+Name\s:\s(?<App_Name>\w+\S+)" | rex field=_raw "(?ms)Sync\sState\s:\s(?<App_State>[\w\s]+\w)\s+Number" | table App_Name,App_State"

App_Name App_State

abc Stopped

cde Running

abc Running

xyz Stopped

the Running

abc Partially running

abc Stopped

xyz Running

the Running

abc Running

and so on.

Here I want to create the table in the below format(the app_state should not repeat for a particular app_name but should be shown once per app_name):

App_Name App_State

abc Running

abc Partially running

abc Stopped

cde Running

xyz Running

xyz Stopped

the Running

I used the "dedup" command along with my above query "index=main host="abcde" | rex field=_raw "(?ms)Label\s+Name\s:\s(?<App_Name>\w+\S+)" | rex field=_raw "(?ms)Sync\sState\s:\s(?<App_State>[\w\s]+\w)\s+Number" | table App_Name,App_State | dedup App_Name"

But I am getting this below output:

App_Name App_State

abc Running

cde Running

xyz Running

the Running

Please help me create the query to get the output in the desired way.

Thank you.

Re: Need help with Splunk query

to4kawa — Thu, 28 Jan 2021 04:34:04 GMT

Re: Need help with Splunk query

493669 — Thu, 28 Jan 2021 04:46:05 GMT

@Mrig342 Try below

...|stats values(App_State) as App_State by App_Name|mvexpand App_State

Re: Need help with Splunk query

Mrig342 — Thu, 28 Jan 2021 06:30:32 GMT

Hi 493669,

Thank you for the prompt response. It worked...!!

Your support is much appreciated...!!