topic Re: Search for Example Events by Field in Splunk Search

Search for Example Events by Field

moogmusic — Wed, 14 Oct 2020 08:29:00 GMT

Hi, I'm trying to search for an example event of different types by field so that I can see the detail of different types of event. So if I do `| stats count by fieldname` and it returns 10 different values for that field, I can see 10 different events in the event view and look at the details of each value of the field. Make sense? Thanks

Re: Search for Example Events by Field

bowesmana — Wed, 14 Oct 2020 09:29:52 GMT

Not sure if this will help for what you're after, but have you tried fieldsummary

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Fieldsummary

Re: Search for Example Events by Field

moogmusic — Thu, 15 Oct 2020 08:03:10 GMT

Thanks - I'm not sure that's quite what I need. If I do `| stats latest(_raw) by fieldname` then I kind of get what I want but it would be good to see the detail in the Events tab rather than the Statistics one so I can use the JSON formatting capabilities for viewing the events.