https://community.splunk.com/t5/Splunk-Search/How-to-extract-specific-field-values-from-Splunk-query/m-p/694464#M236215 <P>What do your raw events look like?</P> Fri, 26 Jul 2024 22:16:50 GMT ITWhisperer 2024-07-26T22:16:50Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-specific-field-values-from-Splunk-query/m-p/694460#M236213 <DIV>Hello,</DIV><DIV>My Splunk query returns the marks of students in the below format.</DIV><DIV>&nbsp;</DIV><DIV>User&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Subject&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Grade</DIV><DIV>John&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Physics&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;D</DIV><DIV><SPAN>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Science&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; A</SPAN></DIV><DIV><SPAN>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Math&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; B</SPAN></DIV><DIV><SPAN>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Social&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; C</SPAN></DIV><DIV><SPAN>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; History&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;D</SPAN></DIV><DIV>Mark&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Physics&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;A</DIV><DIV><SPAN>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Social&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;B</SPAN></DIV><DIV><SPAN>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; History&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;C</SPAN></DIV><DIV>Sam&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Math&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;C</DIV><DIV><SPAN>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Social&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;D</SPAN></DIV><DIV><SPAN>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; History&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; A</SPAN></DIV><DIV>&nbsp;</DIV><DIV>How can I filter the query to show only marks for Physics and Social? Somewhat like the below.</DIV><DIV>User&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Subject&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Grade</DIV><DIV>John&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Physics&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;D</DIV><DIV><SPAN>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Social&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;C</SPAN></DIV><DIV>Mark&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Physics&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;A</DIV><DIV><SPAN>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Social&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;B</SPAN></DIV><DIV>Sam&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Social&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; D</DIV><DIV>&nbsp;</DIV><DIV>Thank you!</DIV><P>&nbsp;</P> Fri, 26 Jul 2024 21:00:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-specific-field-values-from-Splunk-query/m-p/694460#M236213 CuriousSplunky 2024-07-26T21:00:11Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-specific-field-values-from-Splunk-query/m-p/694464#M236215 <P>What do your raw events look like?</P> Fri, 26 Jul 2024 22:16:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-specific-field-values-from-Splunk-query/m-p/694464#M236215 ITWhisperer 2024-07-26T22:16:50Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-specific-field-values-from-Splunk-query/m-p/694467#M236216 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/270527">@CuriousSplunky</a>&nbsp;.. your current search query and the sample data would be better to have.. thanks.&nbsp;</P> Sat, 27 Jul 2024 04:01:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-specific-field-values-from-Splunk-query/m-p/694467#M236216 inventsekar 2024-07-27T04:01:13Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-specific-field-values-from-Splunk-query/m-p/694470#M236217 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/270527">@CuriousSplunky</a>&nbsp;,</P><P>supponing that you created the table using a stats command, you have only to add a search command after the stats:</P><LI-CODE lang="markup">&lt;your_search&gt; | stats values(grade) AS Grade BY User Subject | search Subject IN (Physics, Social)</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Sat, 27 Jul 2024 07:50:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-specific-field-values-from-Splunk-query/m-p/694470#M236217 gcusello 2024-07-27T07:50:59Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-specific-field-values-from-Splunk-query/m-p/694471#M236218 <P>Your data presentation suggests that they were obtained with stats values() which means that you'd have two separate multivalued fields. There is no relation between values in those fields. so you can't (easily) remove corresponding values from both fields. You should filter your values before summarizing them.</P> Sat, 27 Jul 2024 07:58:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-specific-field-values-from-Splunk-query/m-p/694471#M236218 PickleRick 2024-07-27T07:58:01Z