Splunk Search

How to get all field values from large "| stats values(field)" command?

woodcock
Esteemed Legend

Any search that has many field values and ends in "| stats values(field)" will show a short list of field values followed by "[and xxx more values]". How can I get all of the values?

Tags (2)
1 Solution

bwooden
Splunk Employee
Splunk Employee

There are varying ways, depending on the end goal:

You can list them all horizontally in a separated list

... | stats values(said_field) as said_field | mvcombine delim=" " said_field

You can list them in separate results

... | stats values(said_field) as said_field | mvexpand said_field

...and others.

View solution in original post

bwooden
Splunk Employee
Splunk Employee

There are varying ways, depending on the end goal:

You can list them all horizontally in a separated list

... | stats values(said_field) as said_field | mvcombine delim=" " said_field

You can list them in separate results

... | stats values(said_field) as said_field | mvexpand said_field

...and others.

Kawtar
Path Finder

Thank you.

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...