Splunk Search

Splunk Report

runiyal
Path Finder

I have a enteries in logfile that has information like the following two -

transaction sucessful. Request: {empName=Sam, empNum=40012, empMgr=John, empDept=102}
transaction sucessful. Request: {empName=John, empNum=40001, empDept=102}

In this case, empName, empNum, empMgr, empDept are the variables for which each request is sending a value

I want a report that shows all the values under variables for these successful transaction like this

empName empNum  empMgr  empDept
Sam      40012  John         102 
John        40001                102
Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="AndSourcetypeToo"
| kv
| table empName empNum empMgr empDept

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="AndSourcetypeToo"
| kv
| table empName empNum empMgr empDept

View solution in original post

0 Karma

vikramyadav
Contributor

index="yourindexname" source="yoursourcename" | stats count by empName empNum empMgr empDept | fileds - count

0 Karma