Splunk Search

retrieve search fields as table

ma_anand1984
Contributor

I'm extracting a field say JVM (in props.conf). Now I want to write a search where i want JVM in one column and source in another. Just two columns. How can i achieve that?

0 Karma
1 Solution

kristian_kolb
Ultra Champion
* | dedup JVM source | table JVM source

this will create a table with the unique combinations of JVM and source.

* | dedup JVM | table JVM source

will find unique values of JVM, and table them along with the corresponding source value.

/kristian

View solution in original post

kristian_kolb
Ultra Champion
* | dedup JVM source | table JVM source

this will create a table with the unique combinations of JVM and source.

* | dedup JVM | table JVM source

will find unique values of JVM, and table them along with the corresponding source value.

/kristian

ma_anand1984
Contributor

Thank you Kristian. this time im sure gonna tell your wife 😉

MHibbin
Influencer

*| table JVM source

ma_anand1984
Contributor

thank you 🙂

0 Karma

MHibbin
Influencer

... what kristian said 🙂

ma_anand1984
Contributor

Thank you. How can i get only unique values

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...