retrieve search fields as table

Question

I'm extracting a field say JVM (in props.conf). Now I want to write a search where i want JVM in one column and source in another. Just two columns. How can i achieve that?

Accepted Answer

3

* | dedup JVM source | table JVM source

this will create a table with the unique combinations of JVM and source.

* | dedup JVM | table JVM source

will find unique values of JVM, and table them along with the corresponding source value.

/kristian

link

answered 24 Apr '12, 01:26

kristian.kolb
10.0k●6●15
accept rate: 33%

1

Thank you Kristian. this time im sure gonna tell your wife ;)

(24 Apr '12, 01:32) ma_anand1984

Answer 2

1	\| table JVM source link answered 24 Apr '12, 01:05* MHibbin 3.8k●3●12 accept rate: 31% Thank you. How can i get only unique values (24 Apr '12, 01:11) ma_anand1984 1 ... what kristian said :) (24 Apr '12, 01:34) MHibbin thank you :) (24 Apr '12, 01:44) ma_anand1984

retrieve search fields as table

Follow this question

Splunk Resources

Related questions