Splunk Search

group keys having wildcard char like usermetadata_* by other unique field like id

neha19oct97
Engager

Hi All,

I have a requirement to group keys  (key - value pair) having wildcard char like - usermetadata_*  by other unique field value.

Here is the query i am using to get all the keys as column: 

index=<index_name> sourcetype=<source_type> splunk_server_group=default |  stats dc(usermetadata_*) as * | transpose | rename column as usermetadata | table usermetadata

I want the output like this :

id                         usermetadata_keys

xyz                    usermetadata_type

                            usermetadata_eventName

                            usermetadata_date

pqr                    usermetadata_eventType

                           usermetadata_date

 

Labels (2)
0 Karma

General_Talos
Path Finder

Can you share more details.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...