Splunk Search

Why does search only return partial columns?

JohnF
Engager

Hello folks, 

Been busting my head here.. trying to pull data from multiple sourcetypes which I thought would run like:

Index=test sourcetype=A OR sourcetype=B | search host=* | where <appname> ="value" AND 
| table Host, IPAddress, Appname

host is a field in both sourcetypes and IP related info is in B. Just trying to pull out host, it's IP address, and the app in question. What I get is a real long host list (so that's good) with a few IP's and a few apps.. 

Looking abit like this:

Host | IPAddress |Appname

host1 | IP                |
host2 | ip                |
host3 |                     | appname
host4|                      | appname

so on and so forth

seems like any place that shows an ip address refuses to show an appname and vice versa?? 

Still acts the same. I pulled each part separately so I know the data is good. 

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

IP addresses and app names are in separate events and the query shown does nothing to put them together so Splunk shows them as separate events.

There are several ways to put the events together.  The one I like most is the stats command, not for any stats, but for the grouping feature.

index=test sourcetype=A OR sourcetype=B host=* 
| where Appname ="value" 
| stats values(*) as * by host
| table host, IPAddress, Appname
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

IP addresses and app names are in separate events and the query shown does nothing to put them together so Splunk shows them as separate events.

There are several ways to put the events together.  The one I like most is the stats command, not for any stats, but for the grouping feature.

index=test sourcetype=A OR sourcetype=B host=* 
| where Appname ="value" 
| stats values(*) as * by host
| table host, IPAddress, Appname
---
If this reply helps you, an upvote would be appreciated.

JohnF
Engager

let me make sure I got this correct. So in this situation I can go:

 

Stats values(IPAddress) AS IP, values(AppName) by host

|table IPAddress, AppName, Host

0 Karma

PickleRick
Ultra Champion

One small remark - host is one of the default fields and is (or at least should be in a properly working Splunk installation) always filled with a value. So searching for host=* seems a bit pointless.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...