Splunk Search

retrieve search fields as table

ma_anand1984
Contributor

I'm extracting a field say JVM (in props.conf). Now I want to write a search where i want JVM in one column and source in another. Just two columns. How can i achieve that?

0 Karma
1 Solution

kristian_kolb
Ultra Champion
* | dedup JVM source | table JVM source

this will create a table with the unique combinations of JVM and source.

* | dedup JVM | table JVM source

will find unique values of JVM, and table them along with the corresponding source value.

/kristian

View solution in original post

kristian_kolb
Ultra Champion
* | dedup JVM source | table JVM source

this will create a table with the unique combinations of JVM and source.

* | dedup JVM | table JVM source

will find unique values of JVM, and table them along with the corresponding source value.

/kristian

ma_anand1984
Contributor

Thank you Kristian. this time im sure gonna tell your wife 😉

MHibbin
Influencer

*| table JVM source

ma_anand1984
Contributor

thank you 🙂

0 Karma

MHibbin
Influencer

... what kristian said 🙂

ma_anand1984
Contributor

Thank you. How can i get only unique values

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...