topic Re: Condensing multiple table rows into one row in Splunk Search

Condensing multiple table rows into one row

willial — Tue, 22 Apr 2014 16:33:19 GMT

I'm working with a database as my source (through DB Connect) and performing a bunch of different evals. When I go to output it looks like this:

**username      JanTotal   FebTotal   MarTotal**
user1            5
user1                         12
user1                                    8
user2            1
user2                         6
user2                                    3

And so on for multiple users. Try as I might, I can't get it to display simply as:

user1            5            12         8
user2            1             6         3

Is there an easy way to condense these rows into a single row by username? I'll even take a hard way.

Re: Condensing multiple table rows into one row

somesoni2 — Tue, 22 Apr 2014 16:48:35 GMT

You can try stats. something like this

your existing search (with output 1 above) | stats first(*) as * by username

Re: Condensing multiple table rows into one row

martin_mueller — Tue, 22 Apr 2014 17:08:11 GMT

Yup, stats first(*) as * by username is the way to go as long as each field only has up to one value per username.

Re: Condensing multiple table rows into one row

willial — Tue, 22 Apr 2014 18:19:12 GMT

Works perfectly! Thanks!