Hi Team,
I used the below query to extract the log file.
index="test" sourcetype="todayline" | kv pairdelim="\r\n" kvdelim="="
I can able to extract the field name & field value fields as expected.
But I am not able to table the output values. When I use the below query I got the output in different format as below.
| stats values(Application_handle) as Application_Handle,values(Application_ID) AS "ApplicationID",values(Application_name) AS "ApplicationName",values(Application_status) AS "ApplicationStatus"
This is the output I got and also all the events are coming in a single row.
Application_Handle ApplicationID ApplicationName ApplicationStatus
1 10.4 BIBus Excecuting
2 10.7 SAS
3 10.5 bbbb
But I want the the output as each event in a single row.
Application_Handle ApplicationID ApplicationName ApplicationStatus
1 10.4 BIBus Excecuting
2 10.7 SAS Excecuting
3 10.5 bbbb Excecuting
Thanks
Selvan
If you want to table the relevant fields of the events, why not use the actual table command?
index="test" sourcetype="todayline" | kv pairdelim="\r\n" kvdelim="=" | table Application_handle Application_ID Application_name Application_status
can it be done using dedup
instead of stats
try this:
index="test" sourcetype="todayline" | kv pairdelim="\r\n" kvdelim="="|dedup Application_handle Application_ID Application_name Application_status
OR try using stats:
<base_search>| stats values(Application_ID) AS "ApplicationID",values(Application_name) AS "ApplicationName",values(Application_status) AS "ApplicationStatus" by Application_handle