topic Re: retrieve search fields as table in Splunk Search

retrieve search fields as table

ma_anand1984 — Tue, 24 Apr 2012 08:00:23 GMT

I'm extracting a field say JVM (in props.conf). Now I want to write a search where i want JVM in one column and source in another. Just two columns. How can i achieve that?

Re: retrieve search fields as table

MHibbin — Tue, 24 Apr 2012 08:05:11 GMT

*| table JVM source

Re: retrieve search fields as table

ma_anand1984 — Tue, 24 Apr 2012 08:11:58 GMT

Thank you. How can i get only unique values

Re: retrieve search fields as table

kristian_kolb — Tue, 24 Apr 2012 08:26:15 GMT

* | dedup JVM source | table JVM source

this will create a table with the unique combinations of JVM and source.

* | dedup JVM | table JVM source

will find unique values of JVM, and table them along with the corresponding source value.

/kristian

Re: retrieve search fields as table

ma_anand1984 — Tue, 24 Apr 2012 08:32:35 GMT

Thank you Kristian. this time im sure gonna tell your wife 😉

Re: retrieve search fields as table

MHibbin — Tue, 24 Apr 2012 08:34:34 GMT

... what kristian said 🙂

Re: retrieve search fields as table

ma_anand1984 — Tue, 24 Apr 2012 08:44:58 GMT

thank you 🙂