Search code examples
searchsplunksplunk-query

Splunk: Extracting values for table

I have events in my logs that look like 

{
     linesPerSec:    1694.67    
     message:    Status:    
     rowCount:   35600000   
     severity:   info
}

when i make a search like:

index="apps"  app="my-api" message="*Status:*" | table  _time,  linesPerSec, rowCount

This is what my table ends up looking like This is what my table ends up looking like

How do I get the number value away from the key for both linesPerSec and rowCount? I want to see all instances. I tried using values(linesPerSec) but that seemed to aggregate only unique.

Thanks,

Nate

Solution

  • Answer with explanation can be found here: https://answers.splunk.com/answers/756524/extracting-values-for-table.html