Splunk Dev

Filter by fieldname in fieldsummary result

msrama5
Explorer

Hi, from query below I want to filter the results by fieldname matching pattern and fieldsummary should only return the text matching the search string from post result set, my text input is $filter$, how can this query be modified to return data that matches $filter$ ?

environment=test sourcetype = asp afi | fieldsummary maxvals=10

0 Karma
1 Solution

to4kawa
Ultra Champion
environment=test sourcetype = asp afi 
| fieldsummary maxvals=10
| table  $filter$ 

you should do care token's value.

View solution in original post

0 Karma

to4kawa
Ultra Champion
environment=test sourcetype = asp afi 
| fieldsummary maxvals=10
| table  $filter$ 

you should do care token's value.

0 Karma

msrama5
Explorer

filter is only for the fieldname matches, above query is working for $*$ , not working for other filters

0 Karma

msrama5
Explorer

Found it, filter needs to move before fieldsummary
environment=test sourcetype = asp afi | fields $filter$ |
| fieldsummary maxvals=10

0 Karma

msrama5
Explorer

Thanks for all the answers

0 Karma

to4kawa
Ultra Champion

not working for other filters
other?

0 Karma
Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...