How to extract specific field values from Splunk query?

[CuriousSplunky]

Hello,

My Splunk query returns the marks of students in the below format.

User                Subject                 Grade

John                Physics                 D

                          Science                A

                          Math                      B

                          Social                    C

                          History                 D

Mark                Physics               A

                          Social                   B

                          History                 C

Sam                 Math                     C

                          Social                   D

                          History                A

How can I filter the query to show only marks for Physics and Social? Somewhat like the below.

User                Subject              Grade

John                Physics               D

                          Social                   C

Mark                Physics               A

                          Social                   B

Sam                 Social                  D

Thank you!

[PickleRick]

Your data presentation suggests that they were obtained with stats values() which means that you'd have two separate multivalued fields. There is no relation between values in those fields. so you can't (easily) remove corresponding values from both fields. You should filter your values before summarizing them.

[gcusello]

Hi @CuriousSplunky ,

supponing that you created the table using a stats command, you have only to add a search command after the stats:

<your_search>
| stats values(grade) AS Grade BY User Subject
| search Subject IN (Physics, Social)

Ciao.

Giuseppe

[inventsekar]

Hi @CuriousSplunky .. your current search query and the sample data would be better to have.. thanks. 

[ITWhisperer]

What do your raw events look like?