cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
vikramphilar
New Member
Member since: ‎06-14-2016
‎06-05-2020
Community Statistics
Posts 4
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎06-14-2016
Activity Feed
View All

Re: How can I display unique values of a field fro...

by in Splunk Search
‎08-25-2016 09:41 PM
‎08-25-2016 09:41 PM
Thanks, JDukeSplunk. I tried your solution but it only prints the first row along with the column headers, i.e.: ShortName allocated ABCD 600 Am I missing something? ... View more

How can I display unique values of a field from a ...

by in Splunk Search
‎08-25-2016 02:46 AM
‎08-25-2016 02:46 AM
Here's my input: .... .... TradeDetailsDTO [ShortName=ABCD, allocated=600], TradeDetailsDTO [ShortName=EFGH, allocated=400], TradeDetailsDTO [ShortName=IJKL, allocated=300], TradeDetailsDTO [ShortName=MNOP, allocated=700] .... .... Based on the text above, I am trying to get my output to be displayed in a table like below: ShortName allocated ABCD 600 EFGH 400 IJKL 300 MNOP 700 I tried using stats or the foreach commands but neither of them are able to pick up all the four items list in the table above. Note that this list is variable and it may not be 4 items all the time. Please advise. ... View more

Re: How to show multiple values for a single field...

by in Splunk Search
‎06-15-2016 04:00 PM
‎06-15-2016 04:00 PM
Thank you! However, since I am monitoring a log file, I wouldn't know what my raw data would look like. In that case, what would be my input to the eval function? Apologies, I am new to splunk and still learning some of the tricks! ... View more

How to show multiple values for a single field in ...

by in Splunk Search
‎06-14-2016 11:44 PM
‎06-14-2016 11:44 PM
My raw data consists of xml data as below: <fundTemplateName>FUND1</fundTemplateName><quantityExpression>1600</quantityExpression><securityId>ABCD</securityId><fundTemplateName>FUND2</fundTemplateName><quantityExpression>1234</quantityExpression><securityId>EFGH</securityId> Can someone help me get the below output? FUND1 1600 ABCD FUND2 1234 EFGH I am using the below search, but this brings up the last row alone whereas I need both the rows shown above to be printed in my result: "fundTemplateName" source="file location" | xmlkv | table fundTemplateName, quantityExpression, securityId Please help/advise. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM