Splunk Search

Return single field values

aleem
SplunkTrust
SplunkTrust

Hi,
I am importing custom CSV files. I have a field value named "color". I just want to be able to get Splunk to return the value of color. The example below would return "Orange"

Any ideas what the searh might be?

06/03/2012 09:30:00,DX2-MARTINI-GROC-9,80,COM-LIVE / COM-LIVE2 / SECURE-SSL-LIVE,6509-MK2:ACE:1:MK-ACE-16509-MK1:ACE:1:MK-ACE-1,Down,Down,MARTINI-GROCERY-LIVE,,,,Orange,2,9

Be the best version of you
Tags (1)
0 Karma
1 Solution

lguinn2
Legend

If the sourcetype is "csv", then Splunk will extract the fields and name them based on the first line (which is assumed to be a header). So if the first line defined this field with the name Color, you could do this

| table Color

Would return only the color field for each search result.

View solution in original post

0 Karma

lguinn2
Legend

If the sourcetype is "csv", then Splunk will extract the fields and name them based on the first line (which is assumed to be a header). So if the first line defined this field with the name Color, you could do this

| table Color

Would return only the color field for each search result.

0 Karma

aleem
SplunkTrust
SplunkTrust

Excellent, much appreciated

Be the best version of you
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...