Splunk Enterprise Security

Fieldsummary output : remove columns I dont need.

john_shashank
New Member

eventtype=osquery_osquery name="pack_incident_response_*" earliest=-5m
| fieldsummary

output: A table contains multiple columns such as field, count, distinct_count, is_exact, .......etc.

Required output: only one column.

Not working :
|table -count, -distinct_count,

0 Karma
1 Solution

to4kawa
Ultra Champion

use fields instead of table

View solution in original post

codebuilder
SplunkTrust
SplunkTrust

In your example, table will work but your syntax is not correct. Use table to include the values you want.

e.g.

eventtype=osquery_osquery name="pack_incident_response_*" earliest=-5m| fieldsummary | table field, count, max
----
An upvote would be appreciated and Accept Solution if it helps!

john_shashank
New Member

Your command worked completed fine. but as there are multiple packs under the field called "name". I modified the query to the following which did not work for me can you help me with that?

eventtype=osquery_osquery name="pack_incident_response_*" earliest=-5m| fieldsummary | stats value(field), name

0 Karma

codebuilder
SplunkTrust
SplunkTrust

Yes. Take out the "name=", and instead use wildcards around the values.
e.g.
pack_incident_response_

Do the same for any others you want to include.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

codebuilder
SplunkTrust
SplunkTrust

To clarify my previous post, try this method:

eventtype=osquery_osquery name="pack_incident_response_*" earliest=-5m| fieldsummary *pack_incident_response_* | table field, count, max
----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

to4kawa
Ultra Champion

use fields instead of table

john_shashank
New Member

Thanks, that worked,

I have one more question if you can help.

Query:
eventtype=osquery_osquery earliest=-5m
| stats values(fieldsummary) by name
[ | fieldsummary

| fields - count, - distinct_count, - is_exact, - max, - mean, - min, - numeric_count, - stdev, - values]

Looking for the result as :
2 column: name and the field (one column from the fieldsummary search)

Can you help me to modify the query to get the correct answer?

Thanks

0 Karma

to4kawa
Ultra Champion

@john_shashank
please accept my answer.

Your query is not clear. What are you going to know by this query?

ask for another question and provide sample log at the point.

Anyone can't see name and why do you use fieldsummary at this place?
osquery's output has name , I know. but I can't understand what you want to do.

@codebuilder
remove columns I dont need
For this Q, fields is appropriate. so, I think table is good, too.

0 Karma

john_shashank
New Member

I am trying to achieve something like in the picture below.
https://drive.google.com/open?id=1Atr-qDM68Dc_pLy7WsGFeiFbiEvvjha2

this is what I just created for an example. @to4kawa If there is any other way to extract field please feel free to share the syntax. thanks

0 Karma

to4kawa
Ultra Champion

Your query is not clear. What are you going to know by this query?
ask for another question and provide sample log at the point.

another way:

use map and search each name.

0 Karma

codebuilder
SplunkTrust
SplunkTrust

@to4kawa I agree with you, both options work in this case (fields or table), and your suggestion was first, and correct.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

codebuilder
SplunkTrust
SplunkTrust

Did you read my answer?

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...