Splunk Search

How do I get different field values in different fields that are associated with same field value in another field?

90509
Engager

Hi,
could you please help me with below info:

user service name device

abc123 baadmin Brahma Louwps121

bcx123 admin siva louwps123

bxc111 admin Brahma Louwps123

abc123 backup vijay Louwps101

cxz123 backup Brahma Louwps123

cxz123 backup raghu Louwps001

czx101 DM1 Brahma Louwps111

from this if I need to find out "Brahma" with that field value the remaining filed values that are associated with remaining field values in another fields.

Tags (1)
0 Karma
1 Solution

493669
Super Champion

try this-

|stats values(*) as * by name|where name="Brahma"

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @90509,
I'm not sure to understand your need:

  • you want to group your values by name,
  • then you want to display all the values of the other fields for each name and eventually the count of occurrencies,

is this correct?

If this is your need, you should run a search like this:

index=my_index
| stats values(user) AS user values(service) AS service values(device) AS device count BY name

Ciao.
Giuseppe

0 Karma

90509
Engager

Thank you . your function is working ,I apologies for not accepting your answer because he has sent first. I hope you have great journey.

0 Karma

gcusello
SplunkTrust
SplunkTrust

No problem!
Anyway, you can upvote other answer!

Ciao and next time!
Giuseppe

0 Karma

493669
Super Champion

try this-

|stats values(*) as * by name|where name="Brahma"
0 Karma

90509
Engager

Thank you . Have a great journey !

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...