topic Re: Merge rows in one in Splunk Search

Merge rows in one

alex_orl — Tue, 01 Oct 2019 11:44:16 GMT

I have data of the kind

Name       Parameter1            Parameter2           Parameter3
A          1
A                                2                    3
B                                                      3
B                                2

I want to get the result as shown below

Name       Parameter1            Parameter2           Parameter3
A          1                     2                    3
B                                2                    3

Thanks

Re: Merge rows in one

kamlesh_vaghela — Tue, 01 Oct 2019 11:58:42 GMT

@alex_orl

Try this

YOUR_SEARCH | stats values(Parameter1) as Parameter1 values(Parameter2) as Parameter2 values(Parameter3) as Parameter3 by Name

Example:

| makeresults | eval _raw="     Name       Parameter1            Parameter2           Parameter3
     A          1
     A                                2                    3
     B                                                      3
     B                                2                    
"| multikv | stats values(Parameter1) as Parameter1 values(Parameter2) as Parameter2 values(Parameter3) as Parameter3 by Name

Thanks

Re: Merge rows in one

jpolvino — Tue, 01 Oct 2019 11:58:50 GMT

Looking at the top code, will there ever be the case where row 2 and row 3 will both have Parameter1?

You can try something like:
(your search)
| stats list(Parameter1) AS Parameter1 list(Parameter2) AS Parameter2 list(Parameter3) AS Parameter3 BY Name

Re: Merge rows in one

renjith_nair — Tue, 01 Oct 2019 11:59:50 GMT

@alex_orl,

Try

your search | stats values(*) as * by Name

Re: Merge rows in one

bradparks — Tue, 07 Apr 2020 16:24:12 GMT

This totally worked for me thanks a ton! For anyone new to this, the fields will look like they've each been merged into a single value in each Parameter, but are still separate values in a way - they're Multivalues now - so to merge 2 multivalues into one, use mkjoin or mkindex(field,0)+mkindex(field,1)

Re: Merge rows in one

timyong80 — Sun, 02 May 2021 03:15:34 GMT

Thanks! I was looking for this too and it helps. I find that I only need to use the line below without needing | makeresults. Could you explain more about | makeresults?

| multikv | stats values(Parameter1) as Parameter1 values(Parameter2) as Parameter2 values(Parameter3) as Parameter3 by Name

Thank you.