Splunk Search

Alternative to mcatalog values(_value) for Metrics

sandyrite87
Loves-to-Learn

Hello, 

I'm having trouble finding an alternative to the mcatalog values(_value) command for metrics. In the documentation, it says that the values(_value) is not allowed, so what is another way I can just display all the "_value" that was sent to Splunk? For example, i can do | mcatalog values(region) and display all the regions that a user was sending.

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...