Combine the results of a table in one single row

nandhiniG — Tue, 07 Sep 2021 14:41:52 GMT

I have a splunk query that results in a table , while creating alert it just sends the first row of the results ,so we are missing the remaining results. Inorder to address this , i wanted to combine the results in one row or a message to be sent.

QUERY:

| inputlookup gtsnet.csv | fields "dataset_name" | search NOT [search index = asvdataintegration source=piedpiper sts_asvdataintegration_symphony_lambda_clewriter_events | search event.proc_stat_cd = "SCSS" AND event.evt_dtl.EventDesc = "workflow_found" AND event.module_response.requester = "_SUCCESS" AND event.s3_location = "*"s3://cof-data-*/"*"/lake/gtsnet*"*" AND "event.module_name"=LAMBDA | rename event.regrd_dataset_nm as dataset_name | table dataset_name | format]

Current Format:

Expected Format:

Re: Combine the results of a table in one single row

ITWhisperer — Tue, 07 Sep 2021 14:49:43 GMT

| stats list(dataset_name) as dataset_name

Re: Combine the results of a table in one single row

nandhiniG — Tue, 07 Sep 2021 15:09:59 GMT

Thanks a lot it worked!!!

topic Re: Combine the results of a table in one single row in Splunk Search

Combine the results of a table in one single row

Re: Combine the results of a table in one single row

Re: Combine the results of a table in one single row