topic Re: Combining similar results in Splunk Search

Combining similar results

FraserC1 — Thu, 20 Aug 2020 16:21:56 GMT

If I have the below results:

server_name secondary_id
server1 KB4571703
server1 KB4570508
server1 KB4566425
server2 KB4578013
server3 KB4569751
server3 KB4561600
server3 KB4565351
server4 KB4571703
server4 KB4570508

I would like to combine all instances of "server_name" into one row. Similar to below:

server_name secondary_id
server1 KB4571703
KB4570508
KB4566425
server2 KB4578013
server3 KB4569751
KB4561600
KB4565351
server4 KB4571703
KB4570508

Any ideas on how this could be achieved?

Re: Combining similar results

isoutamo — Thu, 20 Aug 2020 16:36:09 GMT

You can try

... | stats values(secondary_id) as secondary_id by server_name | table server_name secondary_id

r. Ismo

Re: Combining similar results

FraserC1 — Thu, 20 Aug 2020 21:22:34 GMT

Hi @isoutamo ,

Thanks for this, that's given me exactly what I was looking for!