Splunk Search

retrieve search fields as table

ma_anand1984
Contributor

I'm extracting a field say JVM (in props.conf). Now I want to write a search where i want JVM in one column and source in another. Just two columns. How can i achieve that?

0 Karma
1 Solution

kristian_kolb
Ultra Champion
* | dedup JVM source | table JVM source

this will create a table with the unique combinations of JVM and source.

* | dedup JVM | table JVM source

will find unique values of JVM, and table them along with the corresponding source value.

/kristian

View solution in original post

kristian_kolb
Ultra Champion
* | dedup JVM source | table JVM source

this will create a table with the unique combinations of JVM and source.

* | dedup JVM | table JVM source

will find unique values of JVM, and table them along with the corresponding source value.

/kristian

ma_anand1984
Contributor

Thank you Kristian. this time im sure gonna tell your wife 😉

MHibbin
Influencer

*| table JVM source

ma_anand1984
Contributor

thank you 🙂

0 Karma

MHibbin
Influencer

... what kristian said 🙂

ma_anand1984
Contributor

Thank you. How can i get only unique values

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...