Splunk Search

How to enumerate values in an individual event?

yuanliu
SplunkTrust
SplunkTrust

In stats, values() can be used to enumerate values fitting the stats criteria. Is there a similar function to do this for individual events? For example, a meal can involve fork, knife and spoon multiple times, but I only want an unordered list of utensils have been used, not the full sequence in which they are used.

Given inputs

07:10 food=milk utensil=bowl utensil=spoon food=cereal utensil=spoon food="scrambled eggs" utensil=fork food=milk utensil=bowl food=banana
12:00  food="hot dog"
18:00  food=salad utensil=fork food=bread utensil=knife food=soup utensil=spoon food=steak utensil=knife utensil=fork food=bread food=apple utensil=knife

I want to have the following utensils values attached to each event:

Breakfast: utensils="bowl, fork, knife, spoon"
Lunch:
Dinner: utensils="fork, knife, spoon"

If there is a field "meal", I can perhaps eventstats values(utensil) as utensils by meal. But meal is not always present. Even _time may not be distinct enough. Besides, when dealing with millions of events, eventstats for values in each events looks insane. Is there a better way?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

This may be a bit brute-force-ish, but is a way of running a stats values() by event:

base search | streamstats count | eventstats values(utensil) as utensils by count

May not scale well for zillions of events.

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...