Splunk Search

Splunk Report

runiyal
Path Finder

I have a enteries in logfile that has information like the following two -

transaction sucessful. Request: {empName=Sam, empNum=40012, empMgr=John, empDept=102}
transaction sucessful. Request: {empName=John, empNum=40001, empDept=102}

In this case, empName, empNum, empMgr, empDept are the variables for which each request is sending a value

I want a report that shows all the values under variables for these successful transaction like this

empName empNum  empMgr  empDept
Sam      40012  John         102 
John        40001                102
Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="AndSourcetypeToo"
| kv
| table empName empNum empMgr empDept

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="AndSourcetypeToo"
| kv
| table empName empNum empMgr empDept
0 Karma

vikramyadav
Contributor

index="yourindexname" source="yoursourcename" | stats count by empName empNum empMgr empDept | fileds - count

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...