topic Re: How to create single row from multiple results? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-create-single-row-from-multiple-results/m-p/585025#M203797 <P>Thank you.&nbsp;</P><P>Is it possible to include the _time when that happened?&nbsp;</P><P>For example, I'd like to know which one is the original and which one is the duplicated</P> Mon, 14 Feb 2022 18:51:59 GMT yk010123 2022-02-14T18:51:59Z How to create single row from multiple results? https://community.splunk.com/t5/Splunk-Search/How-to-create-single-row-from-multiple-results/m-p/585007#M203791 <P>Hi team, I have the following table with results</P> <TABLE border="1" width="56.25%"> <TBODY> <TR> <TD width="25%" height="26px">ID</TD> <TD width="25%" height="26px">processing time</TD> <TD width="25%" height="26px">actor</TD> </TR> <TR> <TD width="25%" height="25px">123</TD> <TD width="25%" height="25px">20</TD> <TD width="25%" height="25px">actor1</TD> </TR> <TR> <TD width="25%" height="25px">123</TD> <TD width="25%" height="25px">30</TD> <TD width="25%" height="25px">actor2</TD> </TR> <TR> <TD width="25%" height="25px">123</TD> <TD width="25%" height="25px">40</TD> <TD width="25%" height="25px">actor3</TD> </TR> </TBODY> </TABLE> <P>&nbsp;</P> <P>And I'd like to combine them as a single result like :&nbsp;</P> <TABLE border="1" width="329px"> <TBODY> <TR> <TD width="103.219px" height="26px">ID</TD> <TD width="107.023px" height="26px">actor1</TD> <TD width="58.875px" height="26px">actor2</TD> <TD width="58.8828px">actor3</TD> </TR> <TR> <TD width="103.219px" height="25px">123</TD> <TD width="107.023px" height="25px">20</TD> <TD width="58.875px" height="25px">30</TD> <TD width="58.8828px">40</TD> </TR> </TBODY> </TABLE> <P>&nbsp;</P> <P>The list of actors is not known in advance&nbsp;</P> <P>Is this possible? Thank you</P> Mon, 14 Feb 2022 17:20:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-single-row-from-multiple-results/m-p/585007#M203791 yk010123 2022-02-14T17:20:43Z Re: How to create single row from multiple results? https://community.splunk.com/t5/Splunk-Search/How-to-create-single-row-from-multiple-results/m-p/585012#M203792 <LI-CODE lang="markup">| xyseries ID 'processing time' actor</LI-CODE> Mon, 14 Feb 2022 17:42:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-single-row-from-multiple-results/m-p/585012#M203792 ITWhisperer 2022-02-14T17:42:55Z Re: How to create single row from multiple results? https://community.splunk.com/t5/Splunk-Search/How-to-create-single-row-from-multiple-results/m-p/585014#M203793 <P>Thank you for replying but that does not seem to be creating the expected output. What I am seeing is&nbsp;</P><P>&nbsp;</P><TABLE border="1" width="100%"><TBODY><TR><TD width="33.333333333333336%">id</TD><TD width="33.333333333333336%">20</TD><TD width="16.666666666666668%">30</TD><TD width="8.333333333333334%">35</TD><TD width="4.166666666666667%">36</TD><TD width="4.166666666666667%">40</TD></TR><TR><TD width="33.333333333333336%">123</TD><TD width="33.333333333333336%">actor1</TD><TD width="16.666666666666668%">actor2</TD><TD width="8.333333333333334%">&nbsp;</TD><TD width="4.166666666666667%">&nbsp;</TD><TD width="4.166666666666667%">actor3</TD></TR></TBODY></TABLE> Mon, 14 Feb 2022 17:50:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-single-row-from-multiple-results/m-p/585014#M203793 yk010123 2022-02-14T17:50:39Z Re: How to create single row from multiple results? https://community.splunk.com/t5/Splunk-Search/How-to-create-single-row-from-multiple-results/m-p/585016#M203794 <P>Sorry, I got that the wrong way around</P><LI-CODE lang="markup">| xyseries ID actor 'processing time'</LI-CODE> Mon, 14 Feb 2022 18:00:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-single-row-from-multiple-results/m-p/585016#M203794 ITWhisperer 2022-02-14T18:00:25Z Re: How to create single row from multiple results? https://community.splunk.com/t5/Splunk-Search/How-to-create-single-row-from-multiple-results/m-p/585019#M203795 <P>Thank you. That seems to be the solution</P><P>Do you know how could I handle duplicates here? For example, sometimes the same actor appears more than once in the results and I'd like to include both somehow(maybe with the _time?)</P> Mon, 14 Feb 2022 18:23:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-single-row-from-multiple-results/m-p/585019#M203795 yk010123 2022-02-14T18:23:42Z Re: How to create single row from multiple results? https://community.splunk.com/t5/Splunk-Search/How-to-create-single-row-from-multiple-results/m-p/585020#M203796 <LI-CODE lang="markup">| chart list('processing time') by ID actor</LI-CODE> Mon, 14 Feb 2022 18:27:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-single-row-from-multiple-results/m-p/585020#M203796 ITWhisperer 2022-02-14T18:27:50Z Re: How to create single row from multiple results? https://community.splunk.com/t5/Splunk-Search/How-to-create-single-row-from-multiple-results/m-p/585025#M203797 <P>Thank you.&nbsp;</P><P>Is it possible to include the _time when that happened?&nbsp;</P><P>For example, I'd like to know which one is the original and which one is the duplicated</P> Mon, 14 Feb 2022 18:51:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-single-row-from-multiple-results/m-p/585025#M203797 yk010123 2022-02-14T18:51:59Z