Grouping syslog events into a table

nzdavidw — Thu, 12 Jun 2014 20:18:09 GMT

Hi,

I am pretty new to Splunk and been pouring over docs but not sure which direction to will resolve this for me. I would appreciate any help with getting the following search to display in a table format. The information is coming from a syslog feed that provides captive web portal information.

The search I am using is;

host="###.###.###.###" "First Name" OR "Last Name" OR Email OR "FollowUp=*"

The results look like this

6/13/14

7:54:36.000 AM
Jun 13 07:54:36 ###.###.###.### ah_auth: FollowUp=Yes host = ###.###.###.### source = Syslog 10514 sourcetype = syslog 6/13/14

7:54:36.000 AM
Jun 13 07:54:36 ###.###.###.### ah_auth: Email=xxxyyy@zzz.com host = ###.###.###.### source = Syslog 10514 sourcetype = syslog 6/13/14

7:54:36.000 AM
Jun 13 07:54:36 ###.###.###.### ah_auth: Last Name=yyy host = ###.###.###.### source = Syslog 10514 sourcetype = syslog 6/13/14

7:54:36.000 AM
Jun 13 07:54:36 ###.###.###.### ah_auth: First Name=xxx host = ###.###.###.### source = Syslog 10514 sourcetype = syslog 6/13/14 7:51:18.000 AM

What I would like to know is how do you group these by the timestamp / groups of these results (in case of simultaneous entries) to just show a table with the column headings of

Email Address | First Name | Last Name | Follow Up

Any help would be greatly appreciated.

Re: Grouping syslog events into a table

somesoni2 — Mon, 28 Sep 2020 16:50:55 GMT

If the timestamp seems to be the same for all 4 records, then try this. (assuming, fields are extracted as FollowUp,Email, Last_Name, First_Name)

host="###.###.###.###" "First Name" OR "Last Name" OR Email OR "FollowUp=*" | stats  values(Email) as "Email Address",values(First_Name) as "First Name",values(Last_Name) as "Last Name",values(FollowUp) as "Follow Up"

topic Re: Grouping syslog events into a table in Getting Data In

Grouping syslog events into a table

Re: Grouping syslog events into a table