topic Re: How to list multiple fields results for multiple fields by hosts. in Splunk Search

How to list multiple fields results for multiple fields by hosts.

dfalone — Tue, 03 Aug 2021 20:34:01 GMT

Hi, I'm pretty new to Splunk and I'm creating a dashboard for one of my environments. One thing I can't figure out is how to populate a table with entries from multiple fields into a table sorted by host. So it should look like this.

HOST VOLUME NAMES

A ARC

B ARC, LIV, FOR

C LIV, FOR, FUN

The host and all of the volume names come from different fields. Any help would be greatly appreciated.

Re: How to list multiple fields results for multiple fields by hosts.

ITWhisperer — Tue, 03 Aug 2021 20:54:29 GMT

Can you share some sample events to show what you are dealing with?

Re: How to list multiple fields results for multiple fields by hosts.

dfalone — Tue, 03 Aug 2021 21:01:30 GMT

I tried the below but I get lots of entries with "empty" vol names and not sure how to also list by Host.

Re: How to list multiple fields results for multiple fields by hosts.

ITWhisperer — Tue, 03 Aug 2021 21:49:05 GMT

Can you share the raw events that you have?

Re: How to list multiple fields results for multiple fields by hosts.

dfalone — Wed, 04 Aug 2021 13:29:58 GMT

Yes, here is an example. Thanks!

timestamp=1628083691 volumeTableDescription.0 = "IND" volumeTableDescription.1 = "NMG" volumeTableProvider.0 = "Amazon S3" volumeTableProvider.1 = "Amazon S3" volumeTableProtocol.0 = "proto_CIFS" volumeTableProtocol.1 = "proto_CIFS" volumeTableStatus.0 = "available" volumeTableStatus.1 = "available" volumeTableAccessibleData.0 = "792058246622" volumeTableAccessibleData.1 = "431253442376050" volumeTableUnprotectedData.0 = "248054173696" volumeTableUnprotectedData.1 = "0" volumeTableLastSnapshotStart.0 = "2021/Aug/04/12.16.31UTC" volumeTableLastSnapshotStart.1 = "2021/Aug/04/13.08.44UTC" volumeTableLastSnapshotEnd.0 = "2021/Aug/04/12.54.49UTC" volumeTableLastSnapshotEnd.1 = "2021/Aug/04/13.08.56UTC" volumeTableLastSnapshotDuration.0 = "2298" volumeTableLastSnapshotDuration.1 = "12" volumeTableLastSnapshotVersion.0 = "318" volumeTableLastSnapshotVersion.1 = "653391" volumeTableIsActive.0 = "1" volumeTableIsActive.1 = "1" volumeTableIsShared.0 = "0" volumeTableIsShared.1 = "0" volumeTableIsReadOnly.0 = "0" volumeTableIsReadOnly.1 = "0" volumeTableIsPinned.0 = "0" volumeTableIsPinned.1 = "0" volumeTableIsRemote.0 = "1" volumeTableIsRemote.1 = "1" volumeTableAvEnabled.0 = "0" volumeTableAvEnabled.1 = "0" volumeTableRemoteAccessEnabled.0 = "0" volumeTableRemoteAccessEnabled.1 = "0" volumeTableQuota.0 = "0" volumeTableQuota.1 = "0" volumeTableNumAVViolations.0 = "0" volumeTableNumAVViolations.1 = "0" volumeTableNumFileAlerts.0 = "0" volumeTableNumFileAlerts.1 = "0" volumeTableNumExports.0 = "0" volumeTableNumExports.1 = "0" volumeTableNumShares.0 = "5" volumeTableNumShares.1 = "5" volumeTableNumFtpdirs.0 = "0" volumeTableNumFtpdirs.1 = "0"

Re: How to list multiple fields results for multiple fields by hosts.

ITWhisperer — Wed, 04 Aug 2021 13:40:48 GMT

Thanks. It looks like that event works with your processing in that you get a mv field with IND and NMG in. Do you have an example of an event that doesn't work, or is it just a case that you want to ignore events which don't work?

Re: How to list multiple fields results for multiple fields by hosts.

dfalone — Wed, 04 Aug 2021 14:11:41 GMT

Your question actually helped, I was using a * in my sourcetype. I changed it to only look at Volume and now the spaces are gone. It now looks like below. How do I add a Host field and show volumes per host?

Re: How to list multiple fields results for multiple fields by hosts.

ITWhisperer — Wed, 04 Aug 2021 14:28:52 GMT

host would normally be added by the forwarders/indexers so you should just be able to reference it

| table host vol_combine

Re: How to list multiple fields results for multiple fields by hosts.

dfalone — Wed, 04 Aug 2021 15:00:58 GMT

That works but now I have multiple entries for the same host reporting the same volume. How do I get it to only list each host once with the respective volumes?

Re: How to list multiple fields results for multiple fields by hosts.

ITWhisperer — Wed, 04 Aug 2021 15:04:23 GMT

| stats values(vol_combine) as vol_combine by host

Re: How to list multiple fields results for multiple fields by hosts.

dfalone — Wed, 04 Aug 2021 18:22:16 GMT

Thank you very much! This is exactly what I needed. 🙂