https://community.splunk.com/t5/Splunk-Search/How-to-group-my-data-so-that-any-values-with-the-same-time-will/m-p/343197#M101628 <P>Hi , I'm very new here with Splunk searches</P> <P>I'm trying to do a group by on my dataset so that any rows with the same time can be aggregated or merged into 1 row.<BR /> eg:)</P> <PRE><CODE>timesec | col1 | col2 |col3 11111 | A | B | C 11111 | A1 | B | C 22222 | D1 | D2 | D3 22222 | E1 | E2 | E3 33333 | tt | tt1 | tt2 </CODE></PRE> <P>and I'm trying to get something like</P> <PRE><CODE>timesec | col1 | col2 | col3 11111 | A , A1 | B | C 22222 | D1,E1 | D2,E2 | D3,E3 33333 | tt | tt1 | tt2 </CODE></PRE> <P>I am not sure if its possible to keep 1 value if its the same or append by comma if its different so I am okay if the result is something like </P> <PRE><CODE>timesec | col1 | col2 | col3 11111 | A , A1 | B,B | C,C 22222 | D1,E1 | D2,E2 | D3,E3 33333 | tt | tt1 | tt2 </CODE></PRE> <P>I been trying to use stats list then by timesec but it seems to only get the timesec and then the rest of the column values are null. I am not too sure what I am doing wrong. Any help would be great. Thanks!</P> Wed, 08 Mar 2017 20:00:27 GMT dcheng123 2017-03-08T20:00:27Z https://community.splunk.com/t5/Splunk-Search/How-to-group-my-data-so-that-any-values-with-the-same-time-will/m-p/343197#M101628 <P>Hi , I'm very new here with Splunk searches</P> <P>I'm trying to do a group by on my dataset so that any rows with the same time can be aggregated or merged into 1 row.<BR /> eg:)</P> <PRE><CODE>timesec | col1 | col2 |col3 11111 | A | B | C 11111 | A1 | B | C 22222 | D1 | D2 | D3 22222 | E1 | E2 | E3 33333 | tt | tt1 | tt2 </CODE></PRE> <P>and I'm trying to get something like</P> <PRE><CODE>timesec | col1 | col2 | col3 11111 | A , A1 | B | C 22222 | D1,E1 | D2,E2 | D3,E3 33333 | tt | tt1 | tt2 </CODE></PRE> <P>I am not sure if its possible to keep 1 value if its the same or append by comma if its different so I am okay if the result is something like </P> <PRE><CODE>timesec | col1 | col2 | col3 11111 | A , A1 | B,B | C,C 22222 | D1,E1 | D2,E2 | D3,E3 33333 | tt | tt1 | tt2 </CODE></PRE> <P>I been trying to use stats list then by timesec but it seems to only get the timesec and then the rest of the column values are null. I am not too sure what I am doing wrong. Any help would be great. Thanks!</P> Wed, 08 Mar 2017 20:00:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-group-my-data-so-that-any-values-with-the-same-time-will/m-p/343197#M101628 dcheng123 2017-03-08T20:00:27Z https://community.splunk.com/t5/Splunk-Search/How-to-group-my-data-so-that-any-values-with-the-same-time-will/m-p/343198#M101629 <P>Try like this</P> <PRE><CODE>your base search | stats values(col1) as col1 values(col2) as col2 values(col3) as col3 by timesec delim="," </CODE></PRE> Wed, 08 Mar 2017 21:30:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-group-my-data-so-that-any-values-with-the-same-time-will/m-p/343198#M101629 somesoni2 2017-03-08T21:30:10Z