https://community.splunk.com/t5/Splunk-Search/How-to-group-each-full-iteration-into-single-fields/m-p/613247#M213121 <P>I have a stats table with output in the below format:</P> <P>Device &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Timestamp &nbsp; &nbsp; &nbsp; &nbsp;Action</P> <P>some value &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;some value. &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1</P> <P>some value &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;some value. &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;2</P> <P>.. &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .. &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;..&nbsp;</P> <P>some value &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;some value &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;10</P> <P>some value &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; some value &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1</P> <P>some value &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;some value. &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;2</P> <P>.. &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .. &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;..&nbsp;</P> <P>some value &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;some value &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;10</P> <P>&nbsp;</P> <P>So, the action column repeats the pattern after a certain number of iterations. How to group these into single fields, that is, each full iteration should be stored as a mv field.</P> <P>&nbsp;</P> Thu, 15 Sep 2022 15:22:42 GMT ABSplunker93 2022-09-15T15:22:42Z https://community.splunk.com/t5/Splunk-Search/How-to-group-each-full-iteration-into-single-fields/m-p/613247#M213121 <P>I have a stats table with output in the below format:</P> <P>Device &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Timestamp &nbsp; &nbsp; &nbsp; &nbsp;Action</P> <P>some value &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;some value. &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1</P> <P>some value &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;some value. &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;2</P> <P>.. &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .. &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;..&nbsp;</P> <P>some value &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;some value &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;10</P> <P>some value &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; some value &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1</P> <P>some value &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;some value. &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;2</P> <P>.. &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .. &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;..&nbsp;</P> <P>some value &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;some value &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;10</P> <P>&nbsp;</P> <P>So, the action column repeats the pattern after a certain number of iterations. How to group these into single fields, that is, each full iteration should be stored as a mv field.</P> <P>&nbsp;</P> Thu, 15 Sep 2022 15:22:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-group-each-full-iteration-into-single-fields/m-p/613247#M213121 ABSplunker93 2022-09-15T15:22:42Z https://community.splunk.com/t5/Splunk-Search/How-to-group-each-full-iteration-into-single-fields/m-p/613284#M213136 <P>The <FONT face="courier new,courier">stats</FONT> command doesn't create arbitrary patterns the results.&nbsp; Either the pattern exists in the data or it's introduced in the query.&nbsp; You may need to add or change the <FONT face="courier new,courier">by</FONT> clause in the stats command.&nbsp; For more specifics, please share the SPL and a sanitized data sample.</P> Thu, 15 Sep 2022 17:12:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-group-each-full-iteration-into-single-fields/m-p/613284#M213136 richgalloway 2022-09-15T17:12:42Z