Splunk Search

How to query for specific string literal field

jaj
Path Finder

I have a filed in my logs "labeDatal" and I also have another field that I trace out called "labelDataSpec"

i.e. log => ".....labelData="whatever1" labelDataSpec="whatever1.1"

How can I run a query that just brings back data for labelData and not labelDataSpec? The following query is bringing back data for labelDataSpec as well (I only want labelData):

source=...labelData| chart count by labelData | sort count | reverse

output example:

labelData count
1 whatever1 15
2 whatever2 100

etc,...

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

Your stats should work like it is - have you verified your data? Anyway, you can remove the field before the stats/chart/timechart/whatever, just to be sure ...

your search | fields - labelDataSpec | chart count by labelData | sort - count 

/K

View solution in original post

kristian_kolb
Ultra Champion

Your stats should work like it is - have you verified your data? Anyway, you can remove the field before the stats/chart/timechart/whatever, just to be sure ...

your search | fields - labelDataSpec | chart count by labelData | sort - count 

/K

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...