Splunk Report

[runiyal]

I have a enteries in logfile that has information like the following two -

transaction sucessful. Request: {empName=Sam, empNum=40012, empMgr=John, empDept=102}
transaction sucessful. Request: {empName=John, empNum=40001, empDept=102}

In this case, empName, empNum, empMgr, empDept are the variables for which each request is sending a value

I want a report that shows all the values under variables for these successful transaction like this

empName empNum  empMgr  empDept
Sam      40012  John         102 
John        40001                102

[woodcock · Accepted solution]

Like this:

index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="AndSourcetypeToo"
| kv
| table empName empNum empMgr empDept

[vikramyadav]

index="yourindexname" source="yoursourcename" | stats count by empName empNum empMgr empDept | fileds - count