How to search for and get all values of a field which occurred, but without the timestamps?

[likejudo]

I only want to know for field methodName=XYZ

All the methodNames that occurred. I do not want the timestamps for each occurrence.

So I want a table

ABC

DEF

...

XYZ

[JacekF]

You can do the following:

| stats values(methodName) as methodName
| mvexpand methodName

The above will be limited to 100 unique values by default. If you have more values than that (Splunk will tell you if there are more) you can try different approach:

| stats count by methodName
| fields - methodName

| fields - count

[likejudo]

Thank you for your reply. There are hundreds of method names in our applications, in the splunk logs.

In the search bar I should enter this? fields - methodName

---

@JacekF wrote:

The above will be limited to 100 unique values by default. If you have more values than that (Splunk will tell you if there are more) you can try different approach:

| stats count by methodName
| fields - methodName

---

[JacekF]

I've made a mistake, there should be

| fields - count

sorry for that.

You need to add below part to the end of your query

| stats count by methodName
| fields - count

[likejudo]

I want the actual values of methodName, not a count. There will be hundreds but I just want the values, and not the timestamps, not the count.

[JacekF]

The stats function will return a table with two columns: methodName and count and as many rows as many you have different method names in methodName field.

The "| fields - count" command will remove count column leaving only methodName column.

[likejudo]

Thank you! I see a table with almost 2K entries. I clicked Save As and then tried to print to pdf.

However, it only has 4 pages when I open the pdf.

Is there any way to get it to save all 2K values?