Getting Data In

How to pick multiple value which has same key name

Deprasad
Path Finder

Log looks like this.

{...\"Key_name\":\"Value\",....},
{...\"Key_name\":\"Value\",....},
{...\"Key_name\":\"Value\",....},
{...\"Key_name\":\"Value\",....},

My query now extracting the first field alone. I've created a query which extracts all 4 value using append search with subsequent string from each row but the search takes lots of time since it involves 4 append search.

All i need now is to fetch all 4 value into the column key_name in a single query.

0 Karma
1 Solution

to4kawa
Ultra Champion
| makeresults
| eval _raw="{\"Key_name\":\"Value\"},
{\"Key_name\":\"Value\"},
{\"Key_name\":\"Value\"},
{\"Key_name\":\"Value\"},"
| rename COMMENT as "this is sample you provided"
| rename COMMENT as "From here, the logic"
| eval _raw=replace(_raw,"^","[")
| eval _raw=replace(_raw,"$","]")
| spath

Hi,@Deprasad
How about this?

View solution in original post

0 Karma

to4kawa
Ultra Champion
| makeresults
| eval _raw="{\"Key_name\":\"Value\"},
{\"Key_name\":\"Value\"},
{\"Key_name\":\"Value\"},
{\"Key_name\":\"Value\"},"
| rename COMMENT as "this is sample you provided"
| rename COMMENT as "From here, the logic"
| eval _raw=replace(_raw,"^","[")
| eval _raw=replace(_raw,"$","]")
| spath

Hi,@Deprasad
How about this?

0 Karma

Deprasad
Path Finder

Thanks @to4kawa !! It worked with max_match command.

0 Karma

groktrev
New Member

Try with duplicates:

| stats list(Key_name)

without duplicates:

| stats values(Key_name)

Add a by clause to group by a related field:

| stats values(Key_name) by other_key_name

0 Karma

Deprasad
Path Finder

Thanks @groktrev !! It worked with max_match command.

0 Karma

niketn
Legend

@Deprasad if your data being indexed is JSON format, why dont you try to parse and ingest only the JSON structure and use INDEXED_EXTRACTION=json for getting the fields auto-extracted during index time and leverage tstats to run faster searches?

PS: Parsing data would be required in case your raw data has some additional contents besides JSON or is not actual JSON file. If you are indexing JSON files directly, all you would need to do is to set INDEXED_EXTRACTION=json in the props.conf.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Deprasad
Path Finder

Thanks for the suggestion @niketnilay !!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Are those separate events or a single event?
Can you share your current query?

---
If this reply helps you, Karma would be appreciated.
0 Karma

aberkow
Builder

Also if you're using a rex command, you can specify a max_match of 0 to return all matches, see the documentation here: https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Rex

0 Karma

Deprasad
Path Finder

@aberkow - Thanks a lot..!! It worked like a charm.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...