topic Re: selfjoin several result rows on different fields in Splunk Search

selfjoin several result rows on different fields

wiar — Fri, 07 May 2021 12:07:30 GMT

I have a search result where each 3 follwing lines are a block I want to join to one row like:

fld1 fld2 fld3 fld4
A               B
                  B      C
         D               C
E               F
                 F        G
         H                G

as a result of the join I want to have:

fld1 fld2 fld3 fld4
A D B C
E H F G

I have tried with the following search, which works partially:

There are two probems:

when running for the first time there is no result.

When modifying a field the first value of this field is returned

There seems to be a problem that on th second and followng run outputcsv does not update fldRows

I am also curious if there is a simpler approach for getting the desired results

Thanks for a response.

Re: selfjoin several result rows on different fields

ITWhisperer — Fri, 07 May 2021 12:57:56 GMT

Will it always be groups of 3?

Re: selfjoin several result rows on different fields

wiar — Fri, 07 May 2021 13:05:18 GMT

@ITWhisperer: yes there are always 3 rows and thanks for your solution, that is exactly what I was searching for

Re: selfjoin several result rows on different fields

wiar — Fri, 07 May 2021 13:32:21 GMT

A side question: what is the reason for the outputcsv file to not always be updated?

Re: selfjoin several result rows on different fields

ITWhisperer — Fri, 07 May 2021 13:39:25 GMT

No idea - my guess would be something to do with caching or sharing resources - are you running with a cluster?