topic How to show all data of one field? in Splunk Search

How to show all data of one field?

userQ — Tue, 22 Nov 2022 14:35:25 GMT

Hello, I put them in context before showing the query.

I have a splunk that I test on it to see the query results because I don't have access to the splunk that has the data.

I have a query that shows me the result of these two hostnames, but I need this same result but on all hostnames, not just these two.

I have 2 queries.

The first query gets me the results of the two teams, although I don't know if it does it because I have the data inserted (I can't find it by index) or it puts them because I use the makeresults (I read that it works in cache and the data doesn't have to be).

I'd like to use the latter as it's easier for me to display results from hostname, in this case it's called ComputerName.

How can I do to show all ComputerName with these same filters?

index=sistemi sourcetype="wineventlog" TaskCategory="Windows Update Agent" AND EventCode IN (20, 27)
| eval day_of_week = lower(strftime(_time, "%A"))
| eval date_string = strftime(_time, "%Y-%m-%d")
| eval Weekend=if(day_of_week="saturday" OR day_of_week="sunday",1,null())
| search Weekend=1
| stats count by Message EventCode ComputerName date_string
| stats list(Message) by ComputerName date_string EventCode

It may simply not be possible to list all the computer names without listing them one by one.

Thanks.

Re: How to show all data of one field

ITWhisperer — Tue, 22 Nov 2022 11:54:22 GMT

I am not sure what you are asking for - all the computer names are listed by the stats call. Do you just want the computer names?

| stats values(ComputerName) as ComputerName

Re: How to show all data of one field

userQ — Tue, 22 Nov 2022 12:42:09 GMT

Hi, sorry if I didn't explain myself well.
I would like to get all the hostnames instead of just naming those two, for example: hostname=*

Referencing the * as all the hostnames there are.

I know the * doesn't work in splunk like in programming languages, it only worked with index=* but not inside the query with the data.

Re: How to show all data of one field

ITWhisperer — Tue, 22 Nov 2022 13:36:00 GMT

Why do you think * only works for index?

By not restricting the hostname i.e. not using a filter, you will be getting events for all hostnames. This is almost the same as hostname=* except that hostname=* will ensure hostname is not null.