Splunk Search

How to show all the field values (including duplicates) in table

gravi
Explorer

Hi

I have Splunk messages that gives the information on course and student enrolled.
My sample message as follows

{
ID:1,
Course:Biology,
UserName:gsmith,
FirstName: George,
LastName:Smith,
NumOfCredits:3
},
{
ID:2,
Course:Biology,
UserName:mmuren,
FirstName: Mary,
LastName:Muren,
NumOfCredits:3
},
{
ID:3,
Course:Biology,
UserName:ksmith,
FirstName: Karen,
LastName:Smith,
NumOfCredits:3
}

And with my search

index=* Application=Course_Details | stats values(Course), values(UserName), values(FirstName), values(LastName), values(NumOfCredits) by  ID
| table Course UserName FirstName LastName NumOfCredits

The result is something like this:

 Course UserName    FirstName   LastName    NumOfCredits
Biology gsmith      George        Smith         3
           mmuren      Mary          Muren  
           ksmith     Karen 

The result that I am expecting is:

 Course UserName    FirstName   LastName    NumOfCredits
Biology gsmith      George        Smith         3
           mmuren      Mary          Muren       3
           ksmith     Karen      Smith         3    

Tried using makemv but that did not work. Could you please help?

Thanks.

0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval _raw="{\"ID\":1,\"Course\":\"Biology\",\"UserName\":\"gsmith\",\"FirstName\":\"George\",\"LastName\":\"Smith\",\"NumOfCredits\":3},{\"ID\":2,\"Course\":\"Biology\",\"UserName\":\"mmuren\",\"FirstName\":\"Mary\",\"LastName\":\"Muren\",\"NumOfCredits\":3},{\"ID\":3,\"Course\":\"Biology\",\"UserName\":\"ksmith\",\"FirstName\":\"Karen\",\"LastName\":\"Smith\",\"NumOfCredits\":3}"
| rex max_match=100 "\"ID\":(?<ID>\d+),\"Course\":\"(?<Course>.+?)\",\"UserName\":\"(?<UserName>.+?)\",\"FirstName\":\"(?<FirstName>.+?)\",\"LastName\":\"(?<LastName>.+?)\",\"NumOfCredits\":(?<NumOfCredits>\d+)"
| fields - _*
`comment("this is sample data")`
| stats list(*) as * by ID
| rename ID as _ID
| foreach *
    [eval <<FIELD>> = mvindex(<<FIELD>>, _ID - 1) ]
| stats list(*) as * by Course

Hi, @gravi
How about this?

gravi
Explorer

This might work. I just used list instead of values and that did the trick.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...