Splunk Search

How to get all field values from large "| stats values(field)" command?

woodcock
Esteemed Legend

Any search that has many field values and ends in "| stats values(field)" will show a short list of field values followed by "[and xxx more values]". How can I get all of the values?

Tags (2)
1 Solution

bwooden
Splunk Employee
Splunk Employee

There are varying ways, depending on the end goal:

You can list them all horizontally in a separated list

... | stats values(said_field) as said_field | mvcombine delim=" " said_field

You can list them in separate results

... | stats values(said_field) as said_field | mvexpand said_field

...and others.

View solution in original post

bwooden
Splunk Employee
Splunk Employee

There are varying ways, depending on the end goal:

You can list them all horizontally in a separated list

... | stats values(said_field) as said_field | mvcombine delim=" " said_field

You can list them in separate results

... | stats values(said_field) as said_field | mvexpand said_field

...and others.

Kawtar
Path Finder

Thank you.

0 Karma
Get Updates on the Splunk Community!

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...