Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How do I get 1 row per value in a basic search
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
with the following search
index=core host="hostname" elementType=ET1 | stats values(randomField)
my output looks something like:
values(randomField)
117440512
117440515
117440516
117440517
117440519
117440520
117440521
117440530
117440531
...
if i download this in the csv format it will all all appear in 2 rows. I want to be able to have the values(randomField) on the 1st row and then 1 row per each subsequent value (e.g. 117440512 on row 2, 117440515 on row 3 ).
How can i alter my search to achieve this?
similar question asked here
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there any reason why you arent using the table command with a dedup following it?
Using values will force it to create a multi value field with distinct values which will give the output on one line.
Using table with dedup will give the unique output in individual rows
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there any reason why you arent using the table command with a dedup following it?
Using values will force it to create a multi value field with distinct values which will give the output on one line.
Using table with dedup will give the unique output in individual rows
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
++
If all you want is to isolate the values of randomField, then you simply need to pipe to table
index=core host="hostname" elementType=ET1 | table randomField
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@ramdaspr tks ...| table randomField | dedup randomField this worked for me.
Index This | When is October more than just the tenth month?
Observe and Secure All Apps with Splunk
What’s New & Next in Splunk SOAR
