topic How to table a KV output? in Splunk Search

How to table a KV output?

senthamilselvan — Thu, 15 Feb 2018 10:09:53 GMT

Hi Team,

I used the below query to extract the log file.

index="test" sourcetype="todayline" | kv pairdelim="\r\n" kvdelim="="

I can able to extract the field name & field value fields as expected.

But I am not able to table the output values. When I use the below query I got the output in different format as below.

| stats values(Application_handle) as Application_Handle,values(Application_ID) AS "ApplicationID",values(Application_name) AS "ApplicationName",values(Application_status) AS "ApplicationStatus"

This is the output I got and also all the events are coming in a single row.

Application_Handle  ApplicationID   ApplicationName     ApplicationStatus
1                                     10.4                         BIBus                              Excecuting
2                                      10.7                        SAS
3                                      10.5                        bbbb

But I want the the output as each event in a single row.

Application_Handle  ApplicationID   ApplicationName     ApplicationStatus
1                                     10.4                         BIBus                              Excecuting
2                                      10.7                        SAS                                  Excecuting
3                                      10.5                        bbbb                               Excecuting

Thanks
Selvan

Re: How to table a KV output?

493669 — Thu, 15 Feb 2018 10:23:33 GMT

can it be done using dedup instead of stats try this:

index="test" sourcetype="todayline" | kv pairdelim="\r\n" kvdelim="="|dedup Application_handle Application_ID Application_name Application_status

OR try using stats:

<base_search>| stats values(Application_ID) AS "ApplicationID",values(Application_name) AS "ApplicationName",values(Application_status) AS "ApplicationStatus" by Application_handle

Re: How to table a KV output?

FrankVl — Thu, 15 Feb 2018 17:56:03 GMT

If you want to table the relevant fields of the events, why not use the actual table command?

index="test" sourcetype="todayline" | kv pairdelim="\r\n" kvdelim="=" | table Application_handle Application_ID Application_name Application_status