Splunk Search

How to make a table containing columns with non-empty values (or other criteria) from non-indexed data?

halr9000
Motivator

I'm doing this REST call to query the system for modular inputs:

| rest /services/data/modular-inputs | table title description

Before running this through the table command, the output was extremely wide because of the way this particular data has fields broken out. My ideal end goal is something like "make me a table of arbitrary REST command output but only include fields which are in every event". I started thinking how to do this with the metadata command when I realized that there is no index metadata to query as this data isn't indexed. Now, I'm out of ideas. TIA

Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

One more workaround

| rest /services/data/modular-inputs  | table [| rest /services/data/modular-inputs | fieldsummary  maxvals=1| eventstats max(count) as max | where count=max | table field | eval field=field."," | mvcombine field | nomv field | rename field as search]

View solution in original post

somesoni2
Revered Legend

One more workaround

| rest /services/data/modular-inputs  | table [| rest /services/data/modular-inputs | fieldsummary  maxvals=1| eventstats max(count) as max | where count=max | table field | eval field=field."," | mvcombine field | nomv field | rename field as search]

halr9000
Motivator

I like this version. It comes out close to 50% faster in my slightly-scientific tests. Thanks!

martin_mueller
SplunkTrust
SplunkTrust

Mildly hacky, but it works:

| rest /services/data/modular-inputs | fillnull value="§%&$&ZH$%%" | untable id field value | eventstats count(eval(isnull(value) OR trim(value)="" OR value="§%&$&ZH$%%")) as nulls by field | where nulls=0 | xyseries id field value

somesoni2
Revered Legend

Nice one!!

halr9000
Motivator

Not sure which to pick! 🙂

martin_mueller
SplunkTrust
SplunkTrust

The one that doesn't need to cheat with a subsearch of course 😛

halr9000
Motivator

I gave ya points. 🙂

Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...