topic Re: Group results based upon matching values from multiple fields? in Splunk Search

Group results based upon matching values from multiple fields?

jtsplunk — Wed, 11 Apr 2012 19:58:48 GMT

I'm indexing a CSV that appears like the following in its raw form:

Filenum,string
1,abc
2,defg
2,abc
3,xyz
3,abc
1,xyz
7,uiop
7,abc
4,defg
5,qazwsx
6,qazwsx
1,uiop
4,abc

etc..

In Splunk both "Filenum" and "String" are correctly being extracted as field names.

I'd like to spit out a table that automatically groups Filenums with two or more matching Strings.

For example, Filenum 1 & 3 can be grouped together since they both have Strings abc & xyz.

Sample desired output:

Filenum     1, 3     abc, xyz
Filenum     1, 7     abc, uiop
Filenum     2, 4     abc, defg

Any ideas?

Thanks!

Re: Group results based upon matching values from multiple fields?

VipulGarg19 — Mon, 30 Apr 2012 07:08:09 GMT

Why not use custom search using python scripts?

Re: Group results based upon matching values from multiple fields?

yannK — Mon, 30 Apr 2012 14:49:42 GMT

partial answer :
Considering that the fields are already extracted, you can do group the Filenum per string.
mysearch | stats values(Filenum) by string

Now you have to figure how to group the filenums together, maybe a sub search.