Archive

Is it possible to display all _raw events from one source

robertlynch2020
Motivator

I have a file call /net/dell569srv/dell569srv2/apps/qa10157_TPK0002437_24367887/TestRunner/logs/20170321-184649.17336.50.cmd.51.archive-and-report.sh.log

In this there are many events in this file, however i want to display all of them in a cell, is it possible to merge them?
I want all _raw events in one cell and to dedup the source.

alt text

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

 index=mlc_live host=TimeSeries sourcetye="TestRunner_logs" | stats list(_raw) BY source

Be aware that the stats commands (e.g. list) are limited to 1000 values inside a multi-value field so if you have more than 1000 events, you will only see the latest 1000 of them.

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

 index=mlc_live host=TimeSeries sourcetye="TestRunner_logs" | stats list(_raw) BY source

Be aware that the stats commands (e.g. list) are limited to 1000 values inside a multi-value field so if you have more than 1000 events, you will only see the latest 1000 of them.

View solution in original post

0 Karma

robertlynch2020
Motivator

This worked cheers.

0 Karma

somesoni2
Revered Legend

Try like this

index=mlc_live host=TimeSeries sourcetye="TestRunner_logs" | stats list(_raw) as RawData by source

robertlynch2020
Motivator

Thanks for this...

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!