Splunk Search

How to display the results without any other field names appended

akarivaratharaj
Communicator

I am trying to execute the below query in Splunk Enterprise.

index=x sourcetype=y|join TABLE_NAME [|inputlookup Domain_Module_List.csv |search (Domain ="Inventory")] |eval DATA_MB =round(DATA_KB/1024,2) |eval INDEX_MB = round(INDEX_SIZE_KB/1024,2) |timechart span=1mon limit=25 sum(DATA_MB) as datamb,sum(INDEX_MB) as indexmb by Domain|foreach indexmb* datamb* [eval size<>='datamd<>'+'indexmd<>']|fields - datamd* indexmd*

Below is the result which I am getting:

_time size: Inventory size: Platform size:Financial
2017-08 1546672397.67 22240.14 745
2017-09 991610023.13 4040.69 603

Time and Domain name are the two fields which I am trying to fetch. Ideally the Domain name display should be Inventory, Platform, Financial but it is showing as size: Inventory size: Platform and size:Financial.

Could anyone please help me to get rid of "size:" from the above results.

0 Karma
1 Solution

cmerriman
Super Champion

there are two ways around removing size: from the results.

first way would be: |rename "size: *" with *

the second way would be: |foreach "size: *" [eval <<MATCHSTR>> = '<<FIELD>>']

the first way is likely more efficient, however, if there was any evaluating you'd want to do on the fields, foreach is a great way to do that to all of them at the same time.
http://docs.splunk.com/Documentation/Splunk/6.6.3/SearchReference/Foreach

View solution in original post

0 Karma

cmerriman
Super Champion

there are two ways around removing size: from the results.

first way would be: |rename "size: *" with *

the second way would be: |foreach "size: *" [eval <<MATCHSTR>> = '<<FIELD>>']

the first way is likely more efficient, however, if there was any evaluating you'd want to do on the fields, foreach is a great way to do that to all of them at the same time.
http://docs.splunk.com/Documentation/Splunk/6.6.3/SearchReference/Foreach

0 Karma

akarivaratharaj
Communicator

Hi cmerriman,

The first query of renaming has worked. Thanks for the help

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...