Splunk Search

How to create a table when my logs have the same field names but different values?

balleste
Engager

I have the following separate event logs in Splunk:

"10/3/2016 11:30:24 AM","42646.7711166204","mail-server-01","mail-server-01","emails Received","emails Received","0 #","100.00"

"10/3/2016 11:30:50 AM","42646.7714199537","mail-server-01","mail-server-01","cpu","cpu","0 #","25.00"

They are different log events, but have the same fields:

  1. 10/3/2016: date
  2. 11:30:50 AM: time
  3. mail-server-01: host
  4. cpu or emails received: sensor
  5. 100.00 or 25.00: value_raw

I'd like to make a table to show the following (but having hard time with the same field values):

|mail-server-01 |100.00 |25.00 |

0 Karma
1 Solution

sundareshr
Legend

Try this

base search | chart values(value_raw) as values over host by sensor

*OR*

base search | chart avg(value_raw) as values over host by sensor

View solution in original post

0 Karma

sundareshr
Legend

Try this

base search | chart values(value_raw) as values over host by sensor

*OR*

base search | chart avg(value_raw) as values over host by sensor
0 Karma

balleste
Engager

Thank you sundareshr! This will work, but if I had multiple sensors that I don't want as part of the table and I only want a subset...is there a better way than doing a query like this?

base search | NOT "disk-free" NOT "mem-usage" | chart values(value_raw) as values over host by sensor

0 Karma

sundareshr
Legend

Yes, you can do

base search NOT (sensor="disk-free" OR sensor="mem-usage") | chart values(value_raw) as values over host by sensor
0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...