Splunk Search

How to create a table based on field extraction

shrirangphadke
Path Finder

Hi,

I have few field extraction created in my Splunk App. For Ex:

firewall_dst
firewall_username
firewall_operation

Now I want to create a table with these fields as columns. For Ex:

Time            firewall_dst    firewall_username   firewall_operation
2015-06-23  log.local         User1                         Save configuration
2015-06-23  log.local         User2                         Del configuration

What is the way to achieve this?
I tried with

| table firewall_dst firewall_username

and with field

| field firewall_dst firewall_username

with no luck.

Please help.

Tags (2)
0 Karma
1 Solution

dolivasoh
Contributor

Are you intentionally trying to call the same field twice?

|table firewall_dst firewall_username firewall_operation

^ should produce the results you're looking to achieve

View solution in original post

dolivasoh
Contributor

Are you intentionally trying to call the same field twice?

|table firewall_dst firewall_username firewall_operation

^ should produce the results you're looking to achieve

shrirangphadke
Path Finder

Can you pls add this as an answer so that I can mark it

shrirangphadke
Path Finder

Hey thanks! It worked, It seems I was doing some silly mistake

0 Karma
Get Updates on the Splunk Community!

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...