Splunk Search
Highlighted

How to show all the field values (including duplicates) in table

Explorer

Hi

I have Splunk messages that gives the information on course and student enrolled.
My sample message as follows

{
ID:1,
Course:Biology,
UserName:gsmith,
FirstName: George,
LastName:Smith,
NumOfCredits:3
},
{
ID:2,
Course:Biology,
UserName:mmuren,
FirstName: Mary,
LastName:Muren,
NumOfCredits:3
},
{
ID:3,
Course:Biology,
UserName:ksmith,
FirstName: Karen,
LastName:Smith,
NumOfCredits:3
}

And with my search

index=* Application=Course_Details | stats values(Course), values(UserName), values(FirstName), values(LastName), values(NumOfCredits) by  ID
| table Course UserName FirstName LastName NumOfCredits

The result is something like this:

 Course UserName    FirstName   LastName    NumOfCredits
Biology gsmith      George        Smith         3
           mmuren      Mary          Muren  
           ksmith     Karen 

The result that I am expecting is:

 Course UserName    FirstName   LastName    NumOfCredits
Biology gsmith      George        Smith         3
           mmuren      Mary          Muren       3
           ksmith     Karen      Smith         3    

Tried using makemv but that did not work. Could you please help?

Thanks.

0 Karma
Highlighted

Re: How to show all the field values (including duplicates) in table

Ultra Champion
| makeresults 
| eval _raw="{\"ID\":1,\"Course\":\"Biology\",\"UserName\":\"gsmith\",\"FirstName\":\"George\",\"LastName\":\"Smith\",\"NumOfCredits\":3},{\"ID\":2,\"Course\":\"Biology\",\"UserName\":\"mmuren\",\"FirstName\":\"Mary\",\"LastName\":\"Muren\",\"NumOfCredits\":3},{\"ID\":3,\"Course\":\"Biology\",\"UserName\":\"ksmith\",\"FirstName\":\"Karen\",\"LastName\":\"Smith\",\"NumOfCredits\":3}"
| rex max_match=100 "\"ID\":(?<ID>\d+),\"Course\":\"(?<Course>.+?)\",\"UserName\":\"(?<UserName>.+?)\",\"FirstName\":\"(?<FirstName>.+?)\",\"LastName\":\"(?<LastName>.+?)\",\"NumOfCredits\":(?<NumOfCredits>\d+)"
| fields - _*
`comment("this is sample data")`
| stats list(*) as * by ID
| rename ID as _ID
| foreach *
    [eval <<FIELD>> = mvindex(<<FIELD>>, _ID - 1) ]
| stats list(*) as * by Course

Hi, @gravi
How about this?

Highlighted

Re: How to show all the field values (including duplicates) in table

Explorer

This might work. I just used list instead of values and that did the trick.

0 Karma