topic Re: How to group togeher the rows based on some field value in splunk in Splunk Search

How to group togeher the rows based on some field value in splunk

disha — Wed, 26 Sep 2012 01:16:58 GMT

I am having a search in my view code and displaying results in the form of table.
small example result:
custid Eventid
10001 200
10001 300
10002 200
10002 100
10002 300

This time each line is coming in each row. Can we group together the same custid with different values on eventid as one row like

        custID   eventid

first row ->10001 200
300
second row->10002 200
100
300

Is there is any way to do that.
Thanks

Re: How to group togeher the rows based on some field value in splunk

_d_ — Wed, 26 Sep 2012 01:33:41 GMT

Try these:

...my search here... | stats list(custID) by eventID

or, if you want unique custID:

...my search here... | stats values(custID) by eventID

Hope this helps,

Re: How to group togeher the rows based on some field value in splunk

disha — Fri, 28 Sep 2012 00:06:09 GMT

Thanks. this thing worked. I need to show some more columns so i just added like
|stats list(eventid), list(time), list(description) by custid

Re: How to group togeher the rows based on some field value in splunk

vsingla1 — Thu, 31 Mar 2016 19:56:52 GMT

After grouping the fields into one list, how do I make this list comma separated?

Re: How to group togeher the rows based on some field value in splunk

gokulakrishnans — Thu, 05 Jul 2018 02:04:50 GMT

This query "stats values(custID) by eventID" worked for me. Over here, how to count the list of custID's and display it in a table?

Re: How to group togeher the rows based on some field value in splunk

unitedmarsupial — Tue, 14 Sep 2021 18:21:19 GMT

Just wanted to add, that those, who want all of their fields to be grouped, can use the asterisk -- instead of painstakingly enumerating them all (and then re-enumerating, when the field-set changes).

This works for all regular fields -- but not for the special ones (like _time), those still must be listed explicitly:

| stats values(*), values(_time), values(_raw) by eventID

Re: How to group togeher the rows based on some field value in splunk

unitedmarsupial — Tue, 14 Sep 2021 18:24:12 GMT

@vsingla1 wrote:
After grouping the fields into one list, how do I make this list comma separated?

This is, what I have somewhere already -- the field Mnemonic (singular), specific to every event, is grouped into Mnemonics (plural), which is then passed to multi-value join:

| eventstats values(Mnemonic) as Mnemonics | eval Mnemonics=mvjoin(Mnemonics, ",")