How to pick multiple value which has same key name

[Deprasad]

Log looks like this.

{...\"Key_name\":\"Value\",....},
{...\"Key_name\":\"Value\",....},
{...\"Key_name\":\"Value\",....},
{...\"Key_name\":\"Value\",....},

My query now extracting the first field alone. I've created a query which extracts all 4 value using append search with subsequent string from each row but the search takes lots of time since it involves 4 append search.

All i need now is to fetch all 4 value into the column key_name in a single query.

[to4kawa · Accepted solution]

| makeresults
| eval _raw="{\"Key_name\":\"Value\"},
{\"Key_name\":\"Value\"},
{\"Key_name\":\"Value\"},
{\"Key_name\":\"Value\"},"
| rename COMMENT as "this is sample you provided"
| rename COMMENT as "From here, the logic"
| eval _raw=replace(_raw,"^","[")
| eval _raw=replace(_raw,"$","]")
| spath

Hi,@Deprasad
How about this?

[Deprasad]

Thanks @to4kawa !! It worked with max_match command.

[groktrev]

Try with duplicates:

| stats list(Key_name)

without duplicates:

| stats values(Key_name)

Add a by clause to group by a related field:

| stats values(Key_name) by other_key_name

[Deprasad]

Thanks @groktrev !! It worked with max_match command.

[niketn]

@Deprasad if your data being indexed is JSON format, why dont you try to parse and ingest only the JSON structure and use INDEXED_EXTRACTION=json for getting the fields auto-extracted during index time and leverage tstats to run faster searches?

PS: Parsing data would be required in case your raw data has some additional contents besides JSON or is not actual JSON file. If you are indexing JSON files directly, all you would need to do is to set INDEXED_EXTRACTION=json in the props.conf.

[Deprasad]

Thanks for the suggestion @niketnilay !!

[richgalloway]

Are those separate events or a single event?
Can you share your current query?

[aberkow]

Also if you're using a rex command, you can specify a max_match of 0 to return all matches, see the documentation here: https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Rex

[Deprasad]

@aberkow - Thanks a lot..!! It worked like a charm.