https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-events-with-same-field-into-one/m-p/495250#M138089 <P>If Count is actually a field, the above should work. If not, try this.</P> <P>your_search<BR /> | stats values(Text) as Text, count as Count by Name<BR /> | table Name, Text, Count<BR /> | eval Text=mvjoin(Text,",")</P> <P>the eval Text mvjoin can be added if you want it to be a comma separated list</P> Fri, 08 May 2020 13:48:01 GMT jrceja313 2020-05-08T13:48:01Z https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-events-with-same-field-into-one/m-p/495247#M138086 <P>I have two rows having follwing values:<BR /> Name Text Count<BR /> A ABC 1<BR /> A EFG 1</P> <P>I want that my result should be displayed in single row showing count as 2 and both the text for a common name = A. Is there a way we can acheive this</P> Fri, 08 May 2020 06:23:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-events-with-same-field-into-one/m-p/495247#M138086 sudeep5689 2020-05-08T06:23:23Z https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-events-with-same-field-into-one/m-p/495248#M138087 <P>Hi @sudeep5689,<BR /> try something like this:</P> <PRE><CODE>your_search | stats values(Text) AS Text sum(Count) AS Count BY Name </CODE></PRE> <P>Ciao.<BR /> Giuseppe</P> Fri, 08 May 2020 07:09:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-events-with-same-field-into-one/m-p/495248#M138087 gcusello 2020-05-08T07:09:03Z https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-events-with-same-field-into-one/m-p/495249#M138088 <P>Hi Thanks for your response, but when i tried this, its not displaying the count .I mean count should be displayed in the count column. but its not displaying it</P> Fri, 08 May 2020 08:56:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-events-with-same-field-into-one/m-p/495249#M138088 sudeep5689 2020-05-08T08:56:56Z https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-events-with-same-field-into-one/m-p/495250#M138089 <P>If Count is actually a field, the above should work. If not, try this.</P> <P>your_search<BR /> | stats values(Text) as Text, count as Count by Name<BR /> | table Name, Text, Count<BR /> | eval Text=mvjoin(Text,",")</P> <P>the eval Text mvjoin can be added if you want it to be a comma separated list</P> Fri, 08 May 2020 13:48:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-events-with-same-field-into-one/m-p/495250#M138089 jrceja313 2020-05-08T13:48:01Z