Filter splunk results into a List

kirti_gupta12 — Wed, 17 Nov 2021 00:01:38 GMT

I have a Splunk query that parses the msg field, fetches the fields from the result and displays them in a table. PFA

Now, the issue is, each field in the row has a unique time, but more than 1 row could have the same fields, except the time as shown in attached file.

Can we enhance the query in a way, that if for more than 1 row, the fields are same except time, then we can have just row with those fields, and times can as be added as a list (separated by commas) to that final row.

Example, if 2 rows are

Value1, time1, Value2, Value3 Value1, time2, Value2, Value3

Then it could be represented as

Value1, {time1, time2}, Value 2, Value3

This would reduce the space the 2 (or more than 2) rows take on the Dashboard page.

Here is the existing query:

index=myIndex "ERROR * ---" "taskExecutor-*" | rex field=msg "^(?<Time>\S+\s+\S+)\s+\S+\s+(?<Error_Code>\d+)[^\]]+\]\s+(?<Service_Name>\S+)\s+:\s+(?<Error_Message>.+)" | table Error_Message Error_Code Service_Name Time | eventstats count as Count by Error_Message Error_Code Service_Name | sort -Count

Any help would be appreciated.

Re: Filter splunk results into a List

scelikok — Wed, 17 Nov 2021 04:30:25 GMT

Hi @kirti_gupta12,

You can try with values() function like below;

index=myIndex "ERROR * ---" "taskExecutor-*" | rex field=msg "^(?<Time>\S+\s+\S+)\s+\S+\s+(?<Error_Code>\d+)[^\]]+\]\s+(?<Service_Name>\S+)\s+:\s+(?<Error_Message>.+)" | table Error_Message Error_Code Service_Name Time | stats count as Count values(Time) as Time by Error_Message Error_Code Service_Name | sort -Count

topic Filter splunk results into a List in Splunk Search

Filter splunk results into a List

Re: Filter splunk results into a List