Group events by mutiple fields

DeXteR — Tue, 01 Sep 2020 14:56:09 GMT

Hi I have some events in splunk which are of this form-

Location: some value(same value can be there in multiple events)

Client: some value(same value can be there in multiple events)

TransactionNumber: some value(Unique for each event)

Transaction Time: some value(Unique for each event)

Now I want a table in this form -

Basically each location can have multiple clients and each client can have different transactions. Transaction number and transaction time are unique and have one to one mapping.

I am using this query in splunk-

| stats list(TransactionNumber) list(TransactionTime) by Location Client

What's happening is I am getting unique combination of location and client but what I want is unique clients to be listed against a particular Location.

This is what i am getting-

How can the query be modified to achieve the same?

Re: Group events by mutiple fields

richgalloway — Tue, 01 Sep 2020 15:52:53 GMT

The only difference I see is the empty cells in the Location field. Is there something else?

Re: Group events by mutiple fields

DeXteR — Tue, 01 Sep 2020 17:16:31 GMT

Yes

topic Re: Group events by mutiple fields in Splunk Search

Group events by mutiple fields

Re: Group events by mutiple fields

Re: Group events by mutiple fields