https://community.splunk.com/t5/Splunk-Search/How-to-Combine-2-rows/m-p/514324#M144350 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225053">@minihyo</a>,</P><P>please, try something like this:</P><LI-CODE lang="markup">| makeresults | eval _raw="COL1 COL2 VALUE c1 c2 Amy c2 c1 Bob c3 c4 Carol c4 c3 David" | multikv forceheader=1 | eval ppp1=COL1.",".COL2, ppp2=COL2.",".COL1 | makemv delim="," ppp1 | makemv delim="," ppp2 | eval ppp1=mvsort(ppp1), ppp2=mvsort(ppp2) | eval ppp=mvindex(ppp1,0)."/".mvindex(ppp1,1) | stats values(VALUE) AS VALUE BY ppp</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Sun, 16 Aug 2020 13:48:04 GMT gcusello 2020-08-16T13:48:04Z https://community.splunk.com/t5/Splunk-Search/How-to-Combine-2-rows/m-p/514296#M144348 <P>Hi,</P><P>&nbsp;I'm new to Splunk. I expect to combine 2 rows like this but dont know how</P><TABLE border="1" width="35.39253539253539%"><TBODY><TR><TD width="10.682110682110686%" height="25px">COL1</TD><TD width="12.74131274131274%" height="25px">COL2</TD><TD width="12.040809964685383%" height="25px">VALUE</TD></TR><TR><TD width="10.682110682110686%" height="25px">c1</TD><TD width="12.74131274131274%" height="25px">c2</TD><TD width="12.040809964685383%" height="25px">Amy</TD></TR><TR><TD width="10.682110682110686%" height="25px">c2</TD><TD width="12.74131274131274%" height="25px">c1</TD><TD width="12.040809964685383%" height="25px">Bob</TD></TR><TR><TD width="10.682110682110686%" height="25px">c3</TD><TD width="12.74131274131274%" height="25px">c4</TD><TD width="12.040809964685383%" height="25px">Carol</TD></TR><TR><TD width="10.682110682110686%" height="25px">c4</TD><TD width="12.74131274131274%" height="25px">c3</TD><TD width="12.040809964685383%" height="25px">David</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>Expected answer</P><TABLE border="1" width="136px"><TBODY><TR><TD width="67px" height="25px">NEWC3</TD><TD width="68px" height="25px">VALUE</TD></TR><TR><TD width="67px" height="25px">c1 / c2</TD><TD width="68px" height="25px"><P>Amy</P><P>Bob</P></TD></TR><TR><TD width="67px" height="25px">c3 / c4</TD><TD width="68px" height="25px"><P>Carol</P><P>David</P></TD></TR></TBODY></TABLE><P>&nbsp;</P><P>Thanks</P> Sun, 16 Aug 2020 08:08:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Combine-2-rows/m-p/514296#M144348 minihyo 2020-08-16T08:08:16Z https://community.splunk.com/t5/Splunk-Search/How-to-Combine-2-rows/m-p/514324#M144350 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225053">@minihyo</a>,</P><P>please, try something like this:</P><LI-CODE lang="markup">| makeresults | eval _raw="COL1 COL2 VALUE c1 c2 Amy c2 c1 Bob c3 c4 Carol c4 c3 David" | multikv forceheader=1 | eval ppp1=COL1.",".COL2, ppp2=COL2.",".COL1 | makemv delim="," ppp1 | makemv delim="," ppp2 | eval ppp1=mvsort(ppp1), ppp2=mvsort(ppp2) | eval ppp=mvindex(ppp1,0)."/".mvindex(ppp1,1) | stats values(VALUE) AS VALUE BY ppp</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Sun, 16 Aug 2020 13:48:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Combine-2-rows/m-p/514324#M144350 gcusello 2020-08-16T13:48:04Z https://community.splunk.com/t5/Splunk-Search/How-to-Combine-2-rows/m-p/514336#M144353 <P>Try this run-anywhere example.</P><LI-CODE lang="markup">| makeresults | eval _raw="COL1 COL2 VALUE c1 c2 Amy c2 c1 Bob c3 c4 Carol c4 c3 David" | multikv forceheader=1 ```Above just defines test data``` | eval COL3=mvappend(COL1, COL2) | eval COL3=mvjoin(mvsort(COL3),",") | stats values(VALUE) as VALUE by COL3</LI-CODE> Sun, 16 Aug 2020 18:01:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Combine-2-rows/m-p/514336#M144353 richgalloway 2020-08-16T18:01:46Z