Splunk Search

Report on all values of fields.

tawollen
Path Finder

I am trying to get a list of all fields values in our splunk server, but not a table..

A table would work, except that each line is unique for all fields in the line.

I want something that just lists all fields

e.g. * | table host os user would give me

host1 windows user1
host1 windows user2
host1 windows user3 
host2 windows user1
host2 windows user2
host2 windows user4 (etc) giving 10,000+ results

What I am trying to get is a list that looks more like this:

host1 windows  user1  
host2 unix     user2
host3 as400    user3
host4          user4
host5
host6

this list should only list each host once, each OS once, each user once.

Searching through the docs, I didn't see anything that would work.

thanks

Tags (2)
1 Solution

Ron_Naken
Splunk Employee
Splunk Employee

Have you tried:

... | stats values(host) values(os) values(user)

Maybe even dress it up a bit for aesthetics:

... | stats values(host) as host values(os) as os values(user) as user

View solution in original post

Ron_Naken
Splunk Employee
Splunk Employee

Have you tried:

... | stats values(host) values(os) values(user)

Maybe even dress it up a bit for aesthetics:

... | stats values(host) as host values(os) as os values(user) as user

ftk
Motivator

How about using dedup?

* | dedup host os user | table host os user
0 Karma

harshal_chakran
Builder

Even I have the same issue. Even after applying dedup, it shows the same table. Kindly help

0 Karma

tawollen
Path Finder

Nope. I still get what looks like example 1 above..

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...