Splunk Search

How to show all the field values (including duplicates) in table

gravi
Explorer

Hi

I have Splunk messages that gives the information on course and student enrolled.
My sample message as follows

{
ID:1,
Course:Biology,
UserName:gsmith,
FirstName: George,
LastName:Smith,
NumOfCredits:3
},
{
ID:2,
Course:Biology,
UserName:mmuren,
FirstName: Mary,
LastName:Muren,
NumOfCredits:3
},
{
ID:3,
Course:Biology,
UserName:ksmith,
FirstName: Karen,
LastName:Smith,
NumOfCredits:3
}

And with my search

index=* Application=Course_Details | stats values(Course), values(UserName), values(FirstName), values(LastName), values(NumOfCredits) by  ID
| table Course UserName FirstName LastName NumOfCredits

The result is something like this:

 Course UserName    FirstName   LastName    NumOfCredits
Biology gsmith      George        Smith         3
           mmuren      Mary          Muren  
           ksmith     Karen 

The result that I am expecting is:

 Course UserName    FirstName   LastName    NumOfCredits
Biology gsmith      George        Smith         3
           mmuren      Mary          Muren       3
           ksmith     Karen      Smith         3    

Tried using makemv but that did not work. Could you please help?

Thanks.

0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval _raw="{\"ID\":1,\"Course\":\"Biology\",\"UserName\":\"gsmith\",\"FirstName\":\"George\",\"LastName\":\"Smith\",\"NumOfCredits\":3},{\"ID\":2,\"Course\":\"Biology\",\"UserName\":\"mmuren\",\"FirstName\":\"Mary\",\"LastName\":\"Muren\",\"NumOfCredits\":3},{\"ID\":3,\"Course\":\"Biology\",\"UserName\":\"ksmith\",\"FirstName\":\"Karen\",\"LastName\":\"Smith\",\"NumOfCredits\":3}"
| rex max_match=100 "\"ID\":(?<ID>\d+),\"Course\":\"(?<Course>.+?)\",\"UserName\":\"(?<UserName>.+?)\",\"FirstName\":\"(?<FirstName>.+?)\",\"LastName\":\"(?<LastName>.+?)\",\"NumOfCredits\":(?<NumOfCredits>\d+)"
| fields - _*
`comment("this is sample data")`
| stats list(*) as * by ID
| rename ID as _ID
| foreach *
    [eval <<FIELD>> = mvindex(<<FIELD>>, _ID - 1) ]
| stats list(*) as * by Course

Hi, @gravi
How about this?

gravi
Explorer

This might work. I just used list instead of values and that did the trick.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...