topic Re: How to list field and their values? in Splunk Search

How to list field and their values?

truongvinh2112 — Wed, 11 Aug 2021 15:24:40 GMT

My log is formatted like this:

labels: {
       app: splunk-kubernetes-metrics
       app.kubernetes.io/managed-by: Helm
       chart: splunk-kubernetes-metrics-1.4.1
       engine: fluentd
       heritage: Helm
       release: splunk-monitor

How do I find a list of fields and their values? I want to list all the values in field labels.

Thanks!

Re: How to list field and their values?

ITWhisperer — Wed, 11 Aug 2021 15:50:15 GMT

| extract | rename labels.* as *

Re: How to list field and their values?

truongvinh2112 — Thu, 12 Aug 2021 03:22:06 GMT

I'm trying to build a K8s dashboard on Splunk. I tried your way but not working. Can you be more specific?

The image above is an example.

Re: How to list field and their values?

ITWhisperer — Thu, 12 Aug 2021 06:04:56 GMT

Sure. What do these images represent? What did you get when you tried my suggestion? Can you share the raw events in a code block </> so we can see what you are dealing with and try some tests?

Re: How to list field and their values?

codebuilder — Thu, 12 Aug 2021 16:59:26 GMT

Are you just trying to find out what fields are available?
If so you can simply run the following and look at the table or click on "events" to see all the fields.
(Use "head" to limit the results or choose a short time span with the time picker so that you dont get back the entire result set.)

index=your_index_name |head 100 |table *