Splunk Search

group keys having wildcard char like usermetadata_* by other unique field like id

neha19oct97
Engager

Hi All,

I have a requirement to group keys  (key - value pair) having wildcard char like - usermetadata_*  by other unique field value.

Here is the query i am using to get all the keys as column: 

index=<index_name> sourcetype=<source_type> splunk_server_group=default |  stats dc(usermetadata_*) as * | transpose | rename column as usermetadata | table usermetadata

I want the output like this :

id                         usermetadata_keys

xyz                    usermetadata_type

                            usermetadata_eventName

                            usermetadata_date

pqr                    usermetadata_eventType

                           usermetadata_date

 

Labels (2)
0 Karma

General_Talos
Path Finder

Can you share more details.

0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...