Splunk Search

Selective display of values where column names are field values

kenbaugher
Path Finder

After looking at some examples online, I was able to come up with the below query, which can display one or more columns of data based on the selection of "sysname".

What we would like to do with this is optionally just two sysnames, and only the rows where the values do not match.

index=idx1 source="file1.log" sysname IN ("SYS1","SYS6")| table sysname value_name value_info | eval {sysname}=value_info | fields - sysname, value_info | stats values(*) as * by value_name

 

The data format is the below and there are a couple hundred value_names for each sysname with varying formats from integer values, to long strings

sysname, value_name, value_info

 

The above query displays the data something like this

value_name            SYS1                     SYS6
name1                       X                             Y
name2                       A                             A
name3                       B                             C

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=idx1 source="file1.log" sysname IN ("SYS1","SYS6")
| table sysname value_name value_info
| eventstats dc(value_info) as distinct_values by value_name
| where distinct_values > 1
| xyseries value_name sysname value_info
0 Karma

kenbaugher
Path Finder

perfect, thank you

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...