Splunk Search

How to extract specific field values from Splunk query?

CuriousSplunky
Loves-to-Learn Lots
Hello,
My Splunk query returns the marks of students in the below format.
 
User                Subject                 Grade
John                Physics                 D
                          Science                A
                          Math                      B
                          Social                    C
                          History                 D
Mark                Physics               A
                          Social                   B
                          History                 C
Sam                 Math                     C
                          Social                   D
                          History                A
 
How can I filter the query to show only marks for Physics and Social? Somewhat like the below.
User                Subject              Grade
John                Physics               D
                          Social                   C
Mark                Physics               A
                          Social                   B
Sam                 Social                  D
 
Thank you!

 

Labels (3)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Your data presentation suggests that they were obtained with stats values() which means that you'd have two separate multivalued fields. There is no relation between values in those fields. so you can't (easily) remove corresponding values from both fields. You should filter your values before summarizing them.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @CuriousSplunky ,

supponing that you created the table using a stats command, you have only to add a search command after the stats:

<your_search>
| stats values(grade) AS Grade BY User Subject
| search Subject IN (Physics, Social)

Ciao.

Giuseppe

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @CuriousSplunky .. your current search query and the sample data would be better to have.. thanks. 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What do your raw events look like?

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...