topic Re: Extract 2 values from different events based on another 2 common fields in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-extract-2-values-from-different-events-based-on-another-2/m-p/618705#M215035 <LI-CODE lang="markup">| stats values(vlan) as vlan values(L2ipaddress) as L2ipaddress by _time user | stats values(vlan) as vlan by L2ipaddress | eval vlan=mvjoin(vlan,",")</LI-CODE> Fri, 28 Oct 2022 09:45:18 GMT ITWhisperer 2022-10-28T09:45:18Z How to extract 2 values from different events based on another 2 common fields? https://community.splunk.com/t5/Splunk-Search/How-to-extract-2-values-from-different-events-based-on-another-2/m-p/618703#M215033 <P>Hello,<BR />I'm new here, tried to find the answer for my problem by failed. I'm looking for a method to extract values from 2 different events. These events have some common fileds but I'm not interested in them being part of output.</P> <P>My events have following fields (there are more, but these I would like to operate on):</P> <P>EventID=10001</P> <P>time=_time</P> <P>user=mike</P> <P>vlan=mikevlan</P> <P>EventID=10002</P> <P>time=_time</P> <P>user=mike</P> <P>L2ipaddress=1.2.3.4</P> <P>What I'm looking at as a result is a table with a combined results from vlan and L2ipaddress columns for which user and time matches then I need to have a list of all vlans grouped by L2ipaddress</P> <P>1.2.3.4|mikevlan,tomvlan,anavlan</P> <P>1.2.3.5|brianvlan,evevlan<BR />etc</P> <P>Any ideas?</P> Fri, 28 Oct 2022 14:12:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-2-values-from-different-events-based-on-another-2/m-p/618703#M215033 BYQ 2022-10-28T14:12:50Z Re: Extract 2 values from different events based on another 2 common fields https://community.splunk.com/t5/Splunk-Search/How-to-extract-2-values-from-different-events-based-on-another-2/m-p/618705#M215035 <LI-CODE lang="markup">| stats values(vlan) as vlan values(L2ipaddress) as L2ipaddress by _time user | stats values(vlan) as vlan by L2ipaddress | eval vlan=mvjoin(vlan,",")</LI-CODE> Fri, 28 Oct 2022 09:45:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-2-values-from-different-events-based-on-another-2/m-p/618705#M215035 ITWhisperer 2022-10-28T09:45:18Z Re: Extract 2 values from different events based on another 2 common fields https://community.splunk.com/t5/Splunk-Search/How-to-extract-2-values-from-different-events-based-on-another-2/m-p/618713#M215039 <P>ITWhisperer - wow! that worked. And the solution is even easier than I thought. I'm greatly appreciated!</P> Fri, 28 Oct 2022 10:53:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-2-values-from-different-events-based-on-another-2/m-p/618713#M215039 BYQ 2022-10-28T10:53:36Z