Splunk Search

How to enumerate values in an individual event?

yuanliu
SplunkTrust
SplunkTrust

In stats, values() can be used to enumerate values fitting the stats criteria. Is there a similar function to do this for individual events? For example, a meal can involve fork, knife and spoon multiple times, but I only want an unordered list of utensils have been used, not the full sequence in which they are used.

Given inputs

07:10 food=milk utensil=bowl utensil=spoon food=cereal utensil=spoon food="scrambled eggs" utensil=fork food=milk utensil=bowl food=banana
12:00  food="hot dog"
18:00  food=salad utensil=fork food=bread utensil=knife food=soup utensil=spoon food=steak utensil=knife utensil=fork food=bread food=apple utensil=knife

I want to have the following utensils values attached to each event:

Breakfast: utensils="bowl, fork, knife, spoon"
Lunch:
Dinner: utensils="fork, knife, spoon"

If there is a field "meal", I can perhaps eventstats values(utensil) as utensils by meal. But meal is not always present. Even _time may not be distinct enough. Besides, when dealing with millions of events, eventstats for values in each events looks insane. Is there a better way?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

This may be a bit brute-force-ish, but is a way of running a stats values() by event:

base search | streamstats count | eventstats values(utensil) as utensils by count

May not scale well for zillions of events.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...