Splunk Search

How to search for and get all values of a field which occurred, but without the timestamps?

likejudo
Loves-to-Learn

I only want to know for field methodName=XYZ

All the methodNames that occurred. I do not want the timestamps for each occurrence.

So I want a table

ABC

DEF

...

XYZ

Labels (1)
0 Karma

JacekF
Path Finder

You can do the following:

| stats values(methodName) as methodName
| mvexpand methodName

The above will be limited to 100 unique values by default. If you have more values than that (Splunk will tell you if there are more) you can try different approach:

| stats count by methodName
| fields - methodName

| fields - count

0 Karma

likejudo
Loves-to-Learn

Thank you for your reply. There are hundreds of method names in our applications, in the splunk logs.

In the search bar I should enter this? fields - methodName


@JacekF wrote:

The above will be limited to 100 unique values by default. If you have more values than that (Splunk will tell you if there are more) you can try different approach:

| stats count by methodName
| fields - methodName




0 Karma

JacekF
Path Finder

I've made a mistake, there should be

| fields - count

sorry for that.

You need to add below part to the end of your query

| stats count by methodName
| fields - count

0 Karma

likejudo
Loves-to-Learn

I want the actual values of methodName, not a count. There will be hundreds but I just want the values, and not the timestamps, not the count.

0 Karma

JacekF
Path Finder

The stats function will return a table with two columns: methodName and count and as many rows as many you have different method names in methodName field.

The "| fields - count" command will remove count column leaving only methodName column.

0 Karma

likejudo
Loves-to-Learn

Thank you! I see a table with almost 2K entries. I clicked Save As and then tried to print to pdf.

However, it only has 4 pages when I open the pdf.

Is there any way to get it to save all 2K values?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...