Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How do I get 1 row per value in a basic search
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
with the following search
index=core host="hostname" elementType=ET1 | stats values(randomField)
my output looks something like:
values(randomField)
117440512
117440515
117440516
117440517
117440519
117440520
117440521
117440530
117440531
...
if i download this in the csv format it will all all appear in 2 rows. I want to be able to have the values(randomField) on the 1st row and then 1 row per each subsequent value (e.g. 117440512 on row 2, 117440515 on row 3 ).
How can i alter my search to achieve this?
similar question asked here
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there any reason why you arent using the table command with a dedup following it?
Using values will force it to create a multi value field with distinct values which will give the output on one line.
Using table with dedup will give the unique output in individual rows
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there any reason why you arent using the table command with a dedup following it?
Using values will force it to create a multi value field with distinct values which will give the output on one line.
Using table with dedup will give the unique output in individual rows
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
++
If all you want is to isolate the values of randomField, then you simply need to pipe to table
index=core host="hostname" elementType=ET1 | table randomField
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@ramdaspr tks ...| table randomField | dedup randomField this worked for me.
Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...
Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...
Reduce and Transform Your Firewall Data with Splunk Data Management
