topic Re: How do I get 1 row per value in a basic search in Splunk Search

How do I get 1 row per value in a basic search

HattrickNZ — Wed, 04 Mar 2015 02:35:54 GMT

with the following search

index=core host="hostname" elementType=ET1 | stats values(randomField)

my output looks something like:

values(randomField)
117440512
117440515
117440516
117440517
117440519
117440520
117440521
117440530
117440531
...

if i download this in the csv format it will all all appear in 2 rows. I want to be able to have the values(randomField) on the 1st row and then 1 row per each subsequent value (e.g. 117440512 on row 2, 117440515 on row 3 ).

How can i alter my search to achieve this?

Re: How do I get 1 row per value in a basic search

ramdaspr — Wed, 04 Mar 2015 02:50:24 GMT

Is there any reason why you arent using the table command with a dedup following it?

Using values will force it to create a multi value field with distinct values which will give the output on one line.
Using table with dedup will give the unique output in individual rows

Re: How do I get 1 row per value in a basic search

emiller42 — Wed, 04 Mar 2015 06:14:23 GMT

If all you want is to isolate the values of randomField, then you simply need to pipe to table

index=core host="hostname" elementType=ET1 | table randomField

Re: How do I get 1 row per value in a basic search

HattrickNZ — Fri, 06 Mar 2015 01:30:28 GMT

@ramdaspr tks ...| table randomField | dedup randomField this worked for me.