Splunk Search

How to get all field values from large "| stats values(field)" command?

woodcock
Esteemed Legend

Any search that has many field values and ends in "| stats values(field)" will show a short list of field values followed by "[and xxx more values]". How can I get all of the values?

Tags (2)
1 Solution

bwooden
Splunk Employee
Splunk Employee

There are varying ways, depending on the end goal:

You can list them all horizontally in a separated list

... | stats values(said_field) as said_field | mvcombine delim=" " said_field

You can list them in separate results

... | stats values(said_field) as said_field | mvexpand said_field

...and others.

View solution in original post

bwooden
Splunk Employee
Splunk Employee

There are varying ways, depending on the end goal:

You can list them all horizontally in a separated list

... | stats values(said_field) as said_field | mvcombine delim=" " said_field

You can list them in separate results

... | stats values(said_field) as said_field | mvexpand said_field

...and others.

Kawtar
Path Finder

Thank you.

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...