Splunk Search

Why does search only return partial columns?

JohnF
Engager

Hello folks, 

Been busting my head here.. trying to pull data from multiple sourcetypes which I thought would run like:

Index=test sourcetype=A OR sourcetype=B | search host=* | where <appname> ="value" AND 
| table Host, IPAddress, Appname

host is a field in both sourcetypes and IP related info is in B. Just trying to pull out host, it's IP address, and the app in question. What I get is a real long host list (so that's good) with a few IP's and a few apps.. 

Looking abit like this:

Host | IPAddress |Appname

host1 | IP                |
host2 | ip                |
host3 |                     | appname
host4|                      | appname

so on and so forth

seems like any place that shows an ip address refuses to show an appname and vice versa?? 

Still acts the same. I pulled each part separately so I know the data is good. 

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

IP addresses and app names are in separate events and the query shown does nothing to put them together so Splunk shows them as separate events.

There are several ways to put the events together.  The one I like most is the stats command, not for any stats, but for the grouping feature.

index=test sourcetype=A OR sourcetype=B host=* 
| where Appname ="value" 
| stats values(*) as * by host
| table host, IPAddress, Appname
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

IP addresses and app names are in separate events and the query shown does nothing to put them together so Splunk shows them as separate events.

There are several ways to put the events together.  The one I like most is the stats command, not for any stats, but for the grouping feature.

index=test sourcetype=A OR sourcetype=B host=* 
| where Appname ="value" 
| stats values(*) as * by host
| table host, IPAddress, Appname
---
If this reply helps you, Karma would be appreciated.

JohnF
Engager

let me make sure I got this correct. So in this situation I can go:

 

Stats values(IPAddress) AS IP, values(AppName) by host

|table IPAddress, AppName, Host

0 Karma

PickleRick
SplunkTrust
SplunkTrust

One small remark - host is one of the default fields and is (or at least should be in a properly working Splunk installation) always filled with a value. So searching for host=* seems a bit pointless.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...