topic Re: Retrieving all fields that have a certain value in Splunk Search

Retrieving all fields that have a certain value

andra_pietraru — Mon, 28 Sep 2020 19:23:03 GMT

My events have a few fields that are of the type:
field_Name=failed
What query should I write to get all that fields names? something that would mean any_field="failed" and retrieve me the name of that field.
I have just started writting queries in Splunk and any help would be much appreciated!

Re: Retrieving all fields that have a certain value

aljohnson_splun — Thu, 02 Apr 2015 16:03:19 GMT

If you search for "failed" - how many fields do you get ? Can you just inspect the fields sidebar for potential matches?

Ultimately, it sounds like the key-value pairings are reversed - using values to search for keys ?

Re: Retrieving all fields that have a certain value

andra_pietraru — Fri, 03 Apr 2015 06:18:53 GMT

I have about 15 different fields that may have "failed" as a value (not all in the same event). Inspecting the fields sidebar doesn't help very much since I would like to have an overview of all that fields , not just one.
You're right, I'm trying to use the value "failed" to retrieve all fields that have it.

Re: Retrieving all fields that have a certain value

aljohnson_splun — Mon, 06 Apr 2015 19:50:49 GMT

Try something like this:

 ... your search
| fieldsummary
| search values=*failed*
| table field

You could actually use eval and the mvsplit on the values field too but it'd be a bit more work to clean it up.

Re: Retrieving all fields that have a certain value

aljohnson_splun — Mon, 06 Apr 2015 19:51:21 GMT

I submitted an answer. Good luck !

Re: Retrieving all fields that have a certain value

stephanefotso — Mon, 06 Apr 2015 23:11:36 GMT

Hello every body!. here is my solution using regular expressions, although i don't know how is your events but if I had a sample of your data, I would have given you the exact search . I suppose that field_Name=failed figure in your events (raw data)

Try this:

................|rex "(?i)^[^\?]*\?(?P<field_Name>[^=]+)=failed"|where field_Name!=""|table field_Name

Here is an example with the _internal index, that you can test.

index=_internal|rex "(?i)^[^\?]*\?(?P<field_Name>[^=]+)=json"|where field_Name!=""|table field_Name

If you still have problems, let's get a sample of your events.

Re: Retrieving all fields that have a certain value

andra_pietraru — Tue, 07 Apr 2015 08:07:43 GMT

It did exactly what I wanted to: list all fields with "failed" as value. Thanks!

Re: Retrieving all fields that have a certain value

skoelpin — Fri, 17 Nov 2017 14:59:24 GMT

Another good solution to this would be to | transpose the fields. This will turn your column names into rows with a new header. This will then give you the ability to do | search field=value

Re: Retrieving all fields that have a certain value

jokertothequinn — Wed, 04 Sep 2024 14:03:38 GMT

| fieldsummary | search values=*\"value\":\"<what value you exactly want to check>\"* | table field