How to merge cells in Splunk

spl10 — Thu, 30 May 2024 17:38:24 GMT

I want to merge the cells in column S.No and share the output to the requestor.

The only ask is Splunk should take all the values seperated in different colours and send three different emails.

Ex S.No.

I should send emails to

S.No

Re: How to merge cells in Splunk

ITWhisperer — Thu, 30 May 2024 22:50:05 GMT

Splunk is not a spreadsheet, having said that you can use the stats command to "merge cells"

| stats min('S No') as "S No" list(*) as * by Appname

Re: How to merge cells in Splunk

bowesmana — Fri, 31 May 2024 02:45:10 GMT

Before this stats command also add this

| filldown Appname

so that empty Appname rows will adopt the name from above

Re: How to merge cells in Splunk

yuanliu — Fri, 31 May 2024 07:16:36 GMT

You need to mind the basics of posing an answerable question: clearly illustrate data input (in text table), illustrate desired output (also in text unless it is a graphic visualization), and explain the logic in clear language. It is really unclear what is the relationship between these field values.

If I have to speculate, Appname, and requestor are always paired, S.No and host are always paired. Is this correct? Based on this, I made up the following mock data:

Appname	S.No	host	logtype	requestor	source
A	1	ghi	somelog	abc@def.com	somelog.jkl
A	1	ghi	somelog	abc@def.com	somelog.klm
A	1	ghi	somelog	abc@def.com	somelog.lmn
B	2	hij	somelog	bcd@efg.com	somelog.klm
B	2	hij	somelog	bcd@efg.com	somelog.jkl
C	3	ijk	somelog	cde@fgh.com	somelog.lmn
C	3	ijk	somelog	cde@fgh.com	somelog.aaa
A	4	xyz	somelog	abc@def.com	somelog.opq
A	4	xyz	somelog	abc@def.com	somelog.opq
A	4	xyz	somelog	abc@def.com	somelog.bbb
B	5	wxy	somelog	bcd@efg.com	somelog.rst
B	5	wxy	somelog	bcd@efg.com	somelog.uvw
C	6	vwx	somelog	cde@fgh.com	somelog.uvw
C	6	vwx	somelog	cde@fgh.com	somelog.rst
C	6	vwx	somelog	cde@fgh.com	somelog.opq
A	7	aaa	somelog	abc@def.com	somelog.klm
A	7	aaa	somelog	abc@def.com	somelog.lmn
A	7	aaa	somelog	abc@def.com	somelog.jkl
B	8	bbb	somelog	bcd@efg.com	somelog.klm
C	9	ccc	somelog	cde@fgh.com	somelog.lmn
C	9	ccc	somelog	cde@fgh.com	somelog.aaa
C	9	ccc	somelog	cde@fgh.com	somelog.bbb
A	10	hij	somelog	abc@def.com	somelog.aaa
B	11	jkl	somelog	bcd@efg.com	somelog.aaa
B	11	jkl	somelog	bcd@efg.com	somelog.bbb
B	11	jkl	somelog	bcd@efg.com	somelog.ccc
C	12	ijk	somelog	cde@fgh.com	somelog.abc
C	12	ijk	somelog	cde@fgh.com	somelog.ccc

As @ITWhisperer says, Splunk is not a spreadsheet. You cannot have cell merge and such. But if you really want to simulate the effect, you can do something like this:

| stats values(source) as source by Appname logtype requestor S.No host | rename S.No as S_No | eval source = mvjoin(source, ", ") | tojson S_No host source | stats values(_raw) as _raw by Appname requestor logtype | eval host = mvmap(_raw, spath(_raw, "host")) | eval S.No = mvmap(_raw, spath(_raw, "S_No")) | eval source = mvmap(_raw, spath(_raw, "source")) | table S.No Appname requestor logtype source

Result from the above mock data is

S.No	Appname	requestor	logtype	source
1 10 4 7	A	abc@def.com	somelog	somelog.jkl, somelog.klm, somelog.lmn somelog.aaa somelog.bbb, somelog.opq somelog.jkl, somelog.klm, somelog.lmn
11 2 5 8	B	bcd@efg.com	somelog	somelog.aaa, somelog.bbb, somelog.ccc somelog.jkl, somelog.klm somelog.rst, somelog.uvw somelog.klm
12 3 6 9	C	cde@fgh.com	somelog	somelog.abc, somelog.ccc somelog.aaa, somelog.lmn somelog.opq, somelog.rst, somelog.uvw somelog.aaa, somelog.bbb, somelog.lmn

Is this something you are looking for?

Here is mock data emulation:

| makeresults format=csv data="S.No, requestor, Appname, host, logtype, source 1, abc@def.com, A, ghi, somelog, somelog.jkl 1, abc@def.com, A, ghi, somelog, somelog.klm 1, abc@def.com, A, ghi, somelog, somelog.lmn 2, bcd@efg.com, B, hij, somelog, somelog.klm 2, bcd@efg.com, B, hij, somelog, somelog.jkl 3, cde@fgh.com, C, ijk, somelog, somelog.lmn 3, cde@fgh.com, C, ijk, somelog, somelog.aaa 4, abc@def.com, A, xyz, somelog, somelog.opq 4, abc@def.com, A, xyz, somelog, somelog.opq 4, abc@def.com, A, xyz, somelog, somelog.bbb 5, bcd@efg.com, B, wxy, somelog, somelog.rst 5, bcd@efg.com, B, wxy, somelog, somelog.uvw 6, cde@fgh.com, C, vwx, somelog, somelog.uvw 6, cde@fgh.com, C, vwx, somelog, somelog.rst 6, cde@fgh.com, C, vwx, somelog, somelog.opq 7, abc@def.com, A, aaa, somelog, somelog.klm 7, abc@def.com, A, aaa, somelog, somelog.lmn 7, abc@def.com, A, aaa, somelog, somelog.jkl 8, bcd@efg.com, B, bbb, somelog, somelog.klm 9, cde@fgh.com, C, ccc, somelog, somelog.lmn 9, cde@fgh.com, C, ccc, somelog, somelog.aaa 9, cde@fgh.com, C, ccc, somelog, somelog.bbb 10, abc@def.com, A, hij, somelog, somelog.aaa 11, bcd@efg.com, B, jkl, somelog, somelog.aaa 11, bcd@efg.com, B, jkl, somelog, somelog.bbb 11, bcd@efg.com, B, jkl, somelog, somelog.ccc 12, cde@fgh.com, C, ijk, somelog, somelog.abc 12, cde@fgh.com, C, ijk, somelog, somelog.ccc" ``` data emulation above ```

Re: How to merge cells in Splunk

spl10 — Fri, 31 May 2024 09:54:23 GMT

Thank you so for the responses @bowesmana @ITWhisperer and a special thanks to @yuanliu.

I really apologize for posting the requirement in an unclear manner, I was extremely fatigued yet desperately needed to find the solution.

Honestly saying I wasn't confident that I would receive the response so quickly and precise.

I sincerely appreciate the community and individuals like you make this as a wonderful forum for discussion.

To be part of this community is an honor.

topic Re: How to merge cells in Splunk in Splunk Search

How to merge cells in Splunk

Re: How to merge cells in Splunk

Re: How to merge cells in Splunk

Re: How to merge cells in Splunk

Re: How to merge cells in Splunk