Splunk Search

How to show all the field values (including duplicates) in table

gravi
Explorer

Hi

I have Splunk messages that gives the information on course and student enrolled.
My sample message as follows

{
ID:1,
Course:Biology,
UserName:gsmith,
FirstName: George,
LastName:Smith,
NumOfCredits:3
},
{
ID:2,
Course:Biology,
UserName:mmuren,
FirstName: Mary,
LastName:Muren,
NumOfCredits:3
},
{
ID:3,
Course:Biology,
UserName:ksmith,
FirstName: Karen,
LastName:Smith,
NumOfCredits:3
}

And with my search

index=* Application=Course_Details | stats values(Course), values(UserName), values(FirstName), values(LastName), values(NumOfCredits) by  ID
| table Course UserName FirstName LastName NumOfCredits

The result is something like this:

 Course UserName    FirstName   LastName    NumOfCredits
Biology gsmith      George        Smith         3
           mmuren      Mary          Muren  
           ksmith     Karen 

The result that I am expecting is:

 Course UserName    FirstName   LastName    NumOfCredits
Biology gsmith      George        Smith         3
           mmuren      Mary          Muren       3
           ksmith     Karen      Smith         3    

Tried using makemv but that did not work. Could you please help?

Thanks.

0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval _raw="{\"ID\":1,\"Course\":\"Biology\",\"UserName\":\"gsmith\",\"FirstName\":\"George\",\"LastName\":\"Smith\",\"NumOfCredits\":3},{\"ID\":2,\"Course\":\"Biology\",\"UserName\":\"mmuren\",\"FirstName\":\"Mary\",\"LastName\":\"Muren\",\"NumOfCredits\":3},{\"ID\":3,\"Course\":\"Biology\",\"UserName\":\"ksmith\",\"FirstName\":\"Karen\",\"LastName\":\"Smith\",\"NumOfCredits\":3}"
| rex max_match=100 "\"ID\":(?<ID>\d+),\"Course\":\"(?<Course>.+?)\",\"UserName\":\"(?<UserName>.+?)\",\"FirstName\":\"(?<FirstName>.+?)\",\"LastName\":\"(?<LastName>.+?)\",\"NumOfCredits\":(?<NumOfCredits>\d+)"
| fields - _*
`comment("this is sample data")`
| stats list(*) as * by ID
| rename ID as _ID
| foreach *
    [eval <<FIELD>> = mvindex(<<FIELD>>, _ID - 1) ]
| stats list(*) as * by Course

Hi, @gravi
How about this?

gravi
Explorer

This might work. I just used list instead of values and that did the trick.

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...