List of properties aggregated by event

turkamit — Thu, 05 Dec 2013 17:30:49 GMT

Hi there,
I am new to Splunk.
I have data with the following structure, where each entry has an event name and a variable list of properties associated with that event:

{event=eventA, properties={propertyName1=123, propertyName2=abc}}

{event=eventA, properties={propertyName1=456, propertyName2=def}}

{event=eventB, properties={propertyName3=789}}

{event=eventC, properties={propertyName4=AAA, propertyName5=BBB}}

Events of type eventA will always have the same number and names of properties, which are different from the names and number of properties that other types of events have.

I want to ignore the values themselves, and create a search that results in a table that summarizes the properties that each event type has:

eventA     propertyName1, propertyName2

eventB     propertyName

eventC     propertyName4, propertyName5

How can I do that?

Re: List of properties aggregated by event

lukejadamec — Thu, 05 Dec 2013 22:26:05 GMT

You can't list the field names in a table other than as a header. The body of the table is for values, like counts.

However, you could create a table with the header:

event propertyName1 propertyName2 propertyName3 propertyName4 propertyName5

and populate the table with counts of propertyNames by event, which would show blanks when the propertyName does not exist for that event:

search event="*" | fillnull value=" " | stats count by event,propertyName1,propertyName2,propertyName3,propertyName4,propertyName5

topic List of properties aggregated by event in Splunk Search

List of properties aggregated by event

Re: List of properties aggregated by event