topic Re: Stats include all fields in Splunk Search

Stats include all fields

tmontney — Mon, 13 Jul 2020 20:59:03 GMT

| stats sum(Score) AS TotalScore, values(value1) AS value1, values(value2) AS value2, values(value3) AS value3, by Username

How can I just add all fields so they're available in an alert, such as sending an email?

anilchaithu — Mon, 13 Jul 2020 21:01:32 GMT

you can use something like this

|stats sum(Score) AS TotalScore values(*) as * by Username

Hope this helps

tmontney — Mon, 13 Jul 2020 21:04:45 GMT

Perfect! I knew there had to be some wildcard support.