Splunk Search

retrieve search fields as table

ma_anand1984
Contributor

I'm extracting a field say JVM (in props.conf). Now I want to write a search where i want JVM in one column and source in another. Just two columns. How can i achieve that?

0 Karma
1 Solution

kristian_kolb
Ultra Champion
* | dedup JVM source | table JVM source

this will create a table with the unique combinations of JVM and source.

* | dedup JVM | table JVM source

will find unique values of JVM, and table them along with the corresponding source value.

/kristian

View solution in original post

kristian_kolb
Ultra Champion
* | dedup JVM source | table JVM source

this will create a table with the unique combinations of JVM and source.

* | dedup JVM | table JVM source

will find unique values of JVM, and table them along with the corresponding source value.

/kristian

ma_anand1984
Contributor

Thank you Kristian. this time im sure gonna tell your wife 😉

MHibbin
Influencer

*| table JVM source

ma_anand1984
Contributor

thank you 🙂

0 Karma

MHibbin
Influencer

... what kristian said 🙂

ma_anand1984
Contributor

Thank you. How can i get only unique values

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...