Hi there,
I am new to Splunk.
I have data with the following structure, where each entry has an event name and a variable list of properties associated with that event:
{event=eventA, properties={propertyName1=123, propertyName2=abc}}
{event=eventA, properties={propertyName1=456, propertyName2=def}}
{event=eventB, properties={propertyName3=789}}
{event=eventC, properties={propertyName4=AAA, propertyName5=BBB}}
Events of type eventA will always have the same number and names of properties, which are different from the names and number of properties that other types of events have.
I want to ignore the values themselves, and create a search that results in a table that summarizes the properties that each event type has:
eventA propertyName1, propertyName2
eventB propertyName
eventC propertyName4, propertyName5
How can I do that?
You can't list the field names in a table other than as a header. The body of the table is for values, like counts.
However, you could create a table with the header:
event propertyName1 propertyName2 propertyName3 propertyName4 propertyName5
and populate the table with counts of propertyNames by event, which would show blanks when the propertyName does not exist for that event:
search event="*" | fillnull value=" " | stats count by event,propertyName1,propertyName2,propertyName3,propertyName4,propertyName5