Splunk Search

Return single field values

aleem
SplunkTrust
SplunkTrust

Hi,
I am importing custom CSV files. I have a field value named "color". I just want to be able to get Splunk to return the value of color. The example below would return "Orange"

Any ideas what the searh might be?

06/03/2012 09:30:00,DX2-MARTINI-GROC-9,80,COM-LIVE / COM-LIVE2 / SECURE-SSL-LIVE,6509-MK2:ACE:1:MK-ACE-16509-MK1:ACE:1:MK-ACE-1,Down,Down,MARTINI-GROCERY-LIVE,,,,Orange,2,9

Be the best version of you
Tags (1)
0 Karma
1 Solution

lguinn2
Legend

If the sourcetype is "csv", then Splunk will extract the fields and name them based on the first line (which is assumed to be a header). So if the first line defined this field with the name Color, you could do this

| table Color

Would return only the color field for each search result.

View solution in original post

0 Karma

lguinn2
Legend

If the sourcetype is "csv", then Splunk will extract the fields and name them based on the first line (which is assumed to be a header). So if the first line defined this field with the name Color, you could do this

| table Color

Would return only the color field for each search result.

0 Karma

aleem
SplunkTrust
SplunkTrust

Excellent, much appreciated

Be the best version of you
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...