https://community.splunk.com/t5/Splunk-Search/How-to-get-the-values-for-the-selected-fields/m-p/381642#M172218 <P>Try like this</P> <PRE><CODE>index=qvmr_soc_r job_type=batch | fields *vip* *snps* | fieldsummary maxvals=1| table field </CODE></PRE> Wed, 27 Mar 2019 16:20:50 GMT somesoni2 2019-03-27T16:20:50Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-values-for-the-selected-fields/m-p/381639#M172215 <P>Hi Guys,</P> <P>I have this query with me. </P> <P>index=qvmr_soc_r job_type=batch |stats dc(<EM>) as * | fields *vip</EM> <EM>snps</EM> | transpose</P> <P>Basically i'm checking the field names that matches with these vip and snps names. </P> <P>But this query is only returning the distinct count not the values of the fields. </P> <P>How to get these values for the specified fields. Any help would be appreciated. </P> <P>Thanks,<BR /> Maniteja</P> Tue, 29 Sep 2020 23:53:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-values-for-the-selected-fields/m-p/381639#M172215 Maniteja81 2020-09-29T23:53:14Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-values-for-the-selected-fields/m-p/381640#M172216 <P>You have to use fields before stats. something like</P> <PRE><CODE>index=qvmr_soc_r job_type=batch |fields vip snps | stats dc(vip) as vip_dc_count dc(snps) as snps_dc_count | transpose </CODE></PRE> Wed, 27 Mar 2019 13:04:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-values-for-the-selected-fields/m-p/381640#M172216 lakshman239 2019-03-27T13:04:28Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-values-for-the-selected-fields/m-p/381641#M172217 <P>What you are looking for is <CODE>| stats values(vip) as VIPs values(snps) as SNPS</CODE> rather than <CODE>dc()</CODE>. </P> <P>This will give you the full list of distinct values in those fields as an multivalue field. Read <A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Multivaluefunctions">here</A> for more info.</P> <P>Hope this helps</P> Wed, 27 Mar 2019 13:27:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-values-for-the-selected-fields/m-p/381641#M172217 aholzer 2019-03-27T13:27:44Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-values-for-the-selected-fields/m-p/381642#M172218 <P>Try like this</P> <PRE><CODE>index=qvmr_soc_r job_type=batch | fields *vip* *snps* | fieldsummary maxvals=1| table field </CODE></PRE> Wed, 27 Mar 2019 16:20:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-values-for-the-selected-fields/m-p/381642#M172218 somesoni2 2019-03-27T16:20:50Z