Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How to extract unique values from events with ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am importing SQL data into Splunk.
Each record contains SessionID, message, and VarValue.
SessionID is always unique, but message and VarValue contain different values
Example
Sessionid = 1234,message="Tower", varValue="site1"
SessionID = 1234,message="Platform",varValue="Wireless"
SessionID = 1234,message="City",varValue="mytown"
Sessionid = 2222,message="Tower", varValue="site2"
SessionID = 2222,message="Platform",varValue="Satellite"
SessionID = 2222,message="City",varValue="mytown"
How can I extract the unique message and varValue into separate variables per unique SessionID?
What I would like to do is display the Platform and City within a single search
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If the data is already in Splunk, and the three fields have been extracted, see if this works (may need some tweaking)
base search here | eval {message}=varValue | stats values(Tower) as Tower values(Platform) as Platform values(City) as City by SessionID
If the fields are not extracted, try this
base search here | extract pairdelim="," kvdelim="=" | eval {message}=varValue | stats values(Tower) as Tower values(Platform) as Platform values(City) as City by SessionID
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If the data is already in Splunk, and the three fields have been extracted, see if this works (may need some tweaking)
base search here | eval {message}=varValue | stats values(Tower) as Tower values(Platform) as Platform values(City) as City by SessionID
If the fields are not extracted, try this
base search here | extract pairdelim="," kvdelim="=" | eval {message}=varValue | stats values(Tower) as Tower values(Platform) as Platform values(City) as City by SessionID
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That worked. Thanks alot!
Only thing is no timestamps are shown when I do the following. Any ideas how to get timestamps?
base search here | extract pairdelim="," kvdelim="=" | eval {message}=varValue | stats values(Tower) as Tower values(Platform) as Platform values(City) as City by SessionID | table _time Tower Platform City SessionID
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Like this
base search here | extract pairdelim="," kvdelim="=" | eval {message}=varValue | table _time Tower Platform City SessionID
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
