topic Re: Selective display of values where column names are field values in Splunk Search

Selective display of values where column names are field values

kenbaugher — Thu, 07 Nov 2024 14:23:08 GMT

After looking at some examples online, I was able to come up with the below query, which can display one or more columns of data based on the selection of "sysname".

What we would like to do with this is optionally just two sysnames, and only the rows where the values do not match.

index=idx1 source="file1.log" sysname IN ("SYS1","SYS6")| table sysname value_name value_info | eval {sysname}=value_info | fields - sysname, value_info | stats values(*) as * by value_name

The data format is the below and there are a couple hundred value_names for each sysname with varying formats from integer values, to long strings

sysname, value_name, value_info

The above query displays the data something like this

value_name SYS1 SYS6
name1 X Y
name2 A A
name3 B C

Re: Selective display of values where column names are field values

ITWhisperer — Thu, 07 Nov 2024 14:39:41 GMT

index=idx1 source="file1.log" sysname IN ("SYS1","SYS6") | table sysname value_name value_info | eventstats dc(value_info) as distinct_values by value_name | where distinct_values > 1 | xyseries value_name sysname value_info

Re: Selective display of values where column names are field values

kenbaugher — Thu, 07 Nov 2024 14:49:25 GMT

perfect, thank you