<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Show All the Results within the Field in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/Show-All-the-Results-within-the-Field/m-p/468773#M191960</link>
    <description>&lt;P&gt;Keldrig2, What search are you running?&lt;/P&gt;

&lt;P&gt;And are you wanting to see the values from the field based on the interesting fields or are you okay with looking at all the results in a table format?&lt;/P&gt;</description>
    <pubDate>Wed, 23 Oct 2019 22:16:52 GMT</pubDate>
    <dc:creator>Sahr_Lebbie</dc:creator>
    <dc:date>2019-10-23T22:16:52Z</dc:date>
    <item>
      <title>Show All the Results within the Field</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Show-All-the-Results-within-the-Field/m-p/468772#M191959</link>
      <description>&lt;P&gt;I want to show all the results within the field itself as I do not want it just show the top 10 limits from the list. I would like to see the result that lowest number of results. Is there a command out there that can show you unlimited results?&lt;/P&gt;</description>
      <pubDate>Wed, 23 Oct 2019 21:36:31 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Show-All-the-Results-within-the-Field/m-p/468772#M191959</guid>
      <dc:creator>keldridg2</dc:creator>
      <dc:date>2019-10-23T21:36:31Z</dc:date>
    </item>
    <item>
      <title>Re: Show All the Results within the Field</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Show-All-the-Results-within-the-Field/m-p/468773#M191960</link>
      <description>&lt;P&gt;Keldrig2, What search are you running?&lt;/P&gt;

&lt;P&gt;And are you wanting to see the values from the field based on the interesting fields or are you okay with looking at all the results in a table format?&lt;/P&gt;</description>
      <pubDate>Wed, 23 Oct 2019 22:16:52 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Show-All-the-Results-within-the-Field/m-p/468773#M191960</guid>
      <dc:creator>Sahr_Lebbie</dc:creator>
      <dc:date>2019-10-23T22:16:52Z</dc:date>
    </item>
    <item>
      <title>Re: Show All the Results within the Field</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Show-All-the-Results-within-the-Field/m-p/468774#M191961</link>
      <description>&lt;P&gt;The &lt;CODE&gt;values&lt;/CODE&gt; and &lt;CODE&gt;list&lt;/CODE&gt; functions of the &lt;CODE&gt;stats&lt;/CODE&gt; command in a search might be what you're looking for based on your question, but I agree with the person above that we likely need a bit more information to adequately answer your question. If you want to try running a search, something like this might be it:&lt;/P&gt;

&lt;P&gt;&lt;CODE&gt;your initial search...&lt;BR /&gt;
| stats values(field) as uniqueValuesFromField, list(field) as listOfValuesFromField by whateverGroupByYouWantOrNone&lt;/CODE&gt;&lt;/P&gt;

&lt;P&gt;another interpretation of your question: you want to see the result with the lowest count:&lt;/P&gt;

&lt;P&gt;&lt;CODE&gt;your initial search...&lt;BR /&gt;
| stats count by field&lt;/CODE&gt;&lt;/P&gt;

&lt;P&gt;Let me know if either of these help!&lt;/P&gt;

&lt;P&gt;EDIT -- Using &lt;CODE&gt;stats&lt;/CODE&gt; with the &lt;CODE&gt;min&lt;/CODE&gt; function seemed to work here&lt;/P&gt;</description>
      <pubDate>Wed, 23 Oct 2019 23:09:29 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Show-All-the-Results-within-the-Field/m-p/468774#M191961</guid>
      <dc:creator>aberkow</dc:creator>
      <dc:date>2019-10-23T23:09:29Z</dc:date>
    </item>
    <item>
      <title>Re: Show All the Results within the Field</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Show-All-the-Results-within-the-Field/m-p/468775#M191962</link>
      <description>&lt;P&gt;I am searching for a eventtype in looking for the lowest values. I do want to see the field based from the interesting fields.&lt;/P&gt;</description>
      <pubDate>Thu, 24 Oct 2019 05:02:34 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Show-All-the-Results-within-the-Field/m-p/468775#M191962</guid>
      <dc:creator>keldridg2</dc:creator>
      <dc:date>2019-10-24T05:02:34Z</dc:date>
    </item>
    <item>
      <title>Re: Show All the Results within the Field</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Show-All-the-Results-within-the-Field/m-p/468776#M191963</link>
      <description>&lt;P&gt;Try using the &lt;CODE&gt;min&lt;/CODE&gt; function in a &lt;CODE&gt;stats&lt;/CODE&gt; command then? &lt;/P&gt;</description>
      <pubDate>Thu, 24 Oct 2019 19:59:05 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Show-All-the-Results-within-the-Field/m-p/468776#M191963</guid>
      <dc:creator>aberkow</dc:creator>
      <dc:date>2019-10-24T19:59:05Z</dc:date>
    </item>
    <item>
      <title>Re: Show All the Results within the Field</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Show-All-the-Results-within-the-Field/m-p/468777#M191964</link>
      <description>&lt;P&gt;Yes, that help me out.&lt;/P&gt;</description>
      <pubDate>Fri, 25 Oct 2019 02:45:50 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Show-All-the-Results-within-the-Field/m-p/468777#M191964</guid>
      <dc:creator>keldridg2</dc:creator>
      <dc:date>2019-10-25T02:45:50Z</dc:date>
    </item>
  </channel>
</rss>

