Splunk Search

How to query for specific string literal field

jaj
Path Finder

I have a filed in my logs "labeDatal" and I also have another field that I trace out called "labelDataSpec"

i.e. log => ".....labelData="whatever1" labelDataSpec="whatever1.1"

How can I run a query that just brings back data for labelData and not labelDataSpec? The following query is bringing back data for labelDataSpec as well (I only want labelData):

source=...labelData| chart count by labelData | sort count | reverse

output example:

labelData count
1 whatever1 15
2 whatever2 100

etc,...

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

Your stats should work like it is - have you verified your data? Anyway, you can remove the field before the stats/chart/timechart/whatever, just to be sure ...

your search | fields - labelDataSpec | chart count by labelData | sort - count 

/K

View solution in original post

kristian_kolb
Ultra Champion

Your stats should work like it is - have you verified your data? Anyway, you can remove the field before the stats/chart/timechart/whatever, just to be sure ...

your search | fields - labelDataSpec | chart count by labelData | sort - count 

/K

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...