https://community.splunk.com/t5/Splunk-Search/Merging-triples-of-rows/m-p/551172#M156409 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>:<BR />Thanks for the solution. It works for the example data I sent you, but my real data have a string prefix and an UUID for the X* and V* values in the following example and look like follows. And here I have a problem with the sorting at the end:</P><P>| makeresults<BR />| eval _raw="fld1,fld2,fld3,fld4<BR />A,,V1<BR />I,,V3<BR />,,V1,X1<BR />,D,,X1<BR />E,,V2<BR />,,V2,X2<BR />,,V3,X3<BR />,H,,X2<BR />,L,,X3"<BR />| multikv forceheader=1<BR />| fields - _* linecount<BR />| streamstats count as row<BR />| eval key=coalesce(fld3,fld4)<BR />| eval key2=coalesce(fld4,fld3)<BR />| sort key key2</P><P>&nbsp;</P><P>fld1 fld2 fld3 fld4 key key2 row<BR />A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; V1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; V1&nbsp;&nbsp; V1&nbsp;&nbsp;&nbsp;&nbsp; 1<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; V1&nbsp;&nbsp;&nbsp; X1&nbsp;&nbsp; V1&nbsp;&nbsp; X1&nbsp;&nbsp;&nbsp;&nbsp; 3&nbsp;<BR />E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; V2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; V2&nbsp;&nbsp; V2&nbsp;&nbsp;&nbsp;&nbsp; 5<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; V2&nbsp;&nbsp;&nbsp; X2&nbsp;&nbsp; V2&nbsp;&nbsp; X2&nbsp;&nbsp;&nbsp;&nbsp; 6<BR />I&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; V3&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; V3&nbsp; V3&nbsp;&nbsp;&nbsp;&nbsp; 2<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; V3&nbsp;&nbsp;&nbsp;&nbsp; X3&nbsp;&nbsp;&nbsp; V3&nbsp; X3&nbsp;&nbsp; &nbsp; 7<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; D&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; X1&nbsp;&nbsp;&nbsp; X1&nbsp; X1&nbsp;&nbsp;&nbsp;&nbsp; 4<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; H&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; X2&nbsp;&nbsp;&nbsp; X2&nbsp; X2&nbsp;&nbsp;&nbsp;&nbsp; 8<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; L&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; X3&nbsp;&nbsp;&nbsp; X3 &nbsp; X3&nbsp;&nbsp;&nbsp;&nbsp; 9</P><P>What I would like to have is row 4 after row 3, row 8 after row 6</P> Tue, 11 May 2021 06:22:06 GMT wiar 2021-05-11T06:22:06Z https://community.splunk.com/t5/Splunk-Search/Merging-triples-of-rows/m-p/551056#M156367 <P>I have the following output from a search</P><P>fld1 fld2 fld3 fld4<BR />A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; B<BR />I&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; J<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; B&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; C<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; D&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; C<BR />E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; F<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; G<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; J&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; K<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; H&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; G<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; L&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; K</P><P>&nbsp;</P><P>I want the following output:</P><P>fld1 fld2 fld3 fld4<BR />A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; B<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; B&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; C<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; D&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; C<BR />E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; F<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; G<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; H&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; G<BR />I &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; J<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; J&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; K<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; L&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; K</P><P>&nbsp;</P><P>There are always triples of rows to place one after the other by using equality of fld3 or fld4, but these are not always following each other.</P><P>The order of the rows being part of a triple is always given as in the example</P><P>&nbsp;</P><P>How can I get that?</P> Mon, 10 May 2021 09:37:20 GMT https://community.splunk.com/t5/Splunk-Search/Merging-triples-of-rows/m-p/551056#M156367 wiar 2021-05-10T09:37:20Z https://community.splunk.com/t5/Splunk-Search/Merging-triples-of-rows/m-p/551063#M156369 <P>Does this work for you?</P><P>&nbsp;</P><LI-CODE lang="markup">| makeresults | eval _raw="fld1,fld2,fld3,fld4 A,,B I,,J ,,B,C ,D,,C E,,F ,,F,G ,,J,K ,H,,G ,L,,K" | multikv forceheader=1 | fields - _* linecount | eval key=coalesce(fld3,fld4) | eval key2=coalesce(fld4,fld3) | sort key key2</LI-CODE><P>&nbsp;</P> Mon, 10 May 2021 10:26:23 GMT https://community.splunk.com/t5/Splunk-Search/Merging-triples-of-rows/m-p/551063#M156369 ITWhisperer 2021-05-10T10:26:23Z https://community.splunk.com/t5/Splunk-Search/Merging-triples-of-rows/m-p/551172#M156409 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>:<BR />Thanks for the solution. It works for the example data I sent you, but my real data have a string prefix and an UUID for the X* and V* values in the following example and look like follows. And here I have a problem with the sorting at the end:</P><P>| makeresults<BR />| eval _raw="fld1,fld2,fld3,fld4<BR />A,,V1<BR />I,,V3<BR />,,V1,X1<BR />,D,,X1<BR />E,,V2<BR />,,V2,X2<BR />,,V3,X3<BR />,H,,X2<BR />,L,,X3"<BR />| multikv forceheader=1<BR />| fields - _* linecount<BR />| streamstats count as row<BR />| eval key=coalesce(fld3,fld4)<BR />| eval key2=coalesce(fld4,fld3)<BR />| sort key key2</P><P>&nbsp;</P><P>fld1 fld2 fld3 fld4 key key2 row<BR />A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; V1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; V1&nbsp;&nbsp; V1&nbsp;&nbsp;&nbsp;&nbsp; 1<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; V1&nbsp;&nbsp;&nbsp; X1&nbsp;&nbsp; V1&nbsp;&nbsp; X1&nbsp;&nbsp;&nbsp;&nbsp; 3&nbsp;<BR />E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; V2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; V2&nbsp;&nbsp; V2&nbsp;&nbsp;&nbsp;&nbsp; 5<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; V2&nbsp;&nbsp;&nbsp; X2&nbsp;&nbsp; V2&nbsp;&nbsp; X2&nbsp;&nbsp;&nbsp;&nbsp; 6<BR />I&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; V3&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; V3&nbsp; V3&nbsp;&nbsp;&nbsp;&nbsp; 2<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; V3&nbsp;&nbsp;&nbsp;&nbsp; X3&nbsp;&nbsp;&nbsp; V3&nbsp; X3&nbsp;&nbsp; &nbsp; 7<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; D&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; X1&nbsp;&nbsp;&nbsp; X1&nbsp; X1&nbsp;&nbsp;&nbsp;&nbsp; 4<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; H&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; X2&nbsp;&nbsp;&nbsp; X2&nbsp; X2&nbsp;&nbsp;&nbsp;&nbsp; 8<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; L&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; X3&nbsp;&nbsp;&nbsp; X3 &nbsp; X3&nbsp;&nbsp;&nbsp;&nbsp; 9</P><P>What I would like to have is row 4 after row 3, row 8 after row 6</P> Tue, 11 May 2021 06:22:06 GMT https://community.splunk.com/t5/Splunk-Search/Merging-triples-of-rows/m-p/551172#M156409 wiar 2021-05-11T06:22:06Z https://community.splunk.com/t5/Splunk-Search/Merging-triples-of-rows/m-p/551327#M156455 <LI-CODE lang="markup">| makeresults | eval _raw="fld1,fld2,fld3,fld4 A,,V1 I,,V3 ,,V1,X1 ,D,,X1 E,,V2 ,,V2,X2 ,,V3,X3 ,H,,X2 ,L,,X3" | multikv forceheader=1 | fields - _* linecount | streamstats count as row | eventstats values(fld4) as fld4group by fld3 | eval fld4group=coalesce(fld4group,fld4) | sort fld4group row</LI-CODE> Wed, 12 May 2021 07:23:39 GMT https://community.splunk.com/t5/Splunk-Search/Merging-triples-of-rows/m-p/551327#M156455 ITWhisperer 2021-05-12T07:23:39Z https://community.splunk.com/t5/Splunk-Search/Merging-triples-of-rows/m-p/551334#M156457 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;</P><P>Thanks a lot for teaching me how to efficiently using splunk!</P><P>Your solution does exactly what I want also with my real data.</P><P>This was a great help for me.</P> Wed, 12 May 2021 09:51:50 GMT https://community.splunk.com/t5/Splunk-Search/Merging-triples-of-rows/m-p/551334#M156457 wiar 2021-05-12T09:51:50Z