Getting Data In

How to pick multiple value which has same key name

Engager

Log looks like this.

{...\"Key_name\":\"Value\",....},
{...\"Key_name\":\"Value\",....},
{...\"Key_name\":\"Value\",....},
{...\"Key_name\":\"Value\",....},

My query now extracting the first field alone. I've created a query which extracts all 4 value using append search with subsequent string from each row but the search takes lots of time since it involves 4 append search.

All i need now is to fetch all 4 value into the column key_name in a single query.

0 Karma
1 Solution

Ultra Champion
| makeresults
| eval _raw="{\"Key_name\":\"Value\"},
{\"Key_name\":\"Value\"},
{\"Key_name\":\"Value\"},
{\"Key_name\":\"Value\"},"
| rename COMMENT as "this is sample you provided"
| rename COMMENT as "From here, the logic"
| eval _raw=replace(_raw,"^","[")
| eval _raw=replace(_raw,"$","]")
| spath

Hi,@Deprasad
How about this?

View solution in original post

0 Karma

Ultra Champion
| makeresults
| eval _raw="{\"Key_name\":\"Value\"},
{\"Key_name\":\"Value\"},
{\"Key_name\":\"Value\"},
{\"Key_name\":\"Value\"},"
| rename COMMENT as "this is sample you provided"
| rename COMMENT as "From here, the logic"
| eval _raw=replace(_raw,"^","[")
| eval _raw=replace(_raw,"$","]")
| spath

Hi,@Deprasad
How about this?

View solution in original post

0 Karma

Engager

Thanks @to4kawa !! It worked with max_match command.

0 Karma

New Member

Try with duplicates:

| stats list(Key_name)

without duplicates:

| stats values(Key_name)

Add a by clause to group by a related field:

| stats values(Key_name) by other_key_name

0 Karma

Engager

Thanks @groktrev !! It worked with max_match command.

0 Karma

SplunkTrust
SplunkTrust

@Deprasad if your data being indexed is JSON format, why dont you try to parse and ingest only the JSON structure and use INDEXED_EXTRACTION=json for getting the fields auto-extracted during index time and leverage tstats to run faster searches?

PS: Parsing data would be required in case your raw data has some additional contents besides JSON or is not actual JSON file. If you are indexing JSON files directly, all you would need to do is to set INDEXED_EXTRACTION=json in the props.conf.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Engager

Thanks for the suggestion @niketnilay !!

0 Karma

SplunkTrust
SplunkTrust

Are those separate events or a single event?
Can you share your current query?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Builder

Also if you're using a rex command, you can specify a max_match of 0 to return all matches, see the documentation here: https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Rex

0 Karma

Engager

@aberkow - Thanks a lot..!! It worked like a charm.

0 Karma