topic Re: How do I consolidate the values returned from a database query into a single entry? in Splunk Search

How do I consolidate the values returned from a database query into a single entry?

edpeyregne — Wed, 03 Jun 2015 15:03:13 GMT

I am running search against a database that includes a username and ticket count (from our ticketing system). When the results come back, I have one user who is listed with multiple iterations of their name. For example:

Username Count
John Q User 5
John Quser 3
John User 6

These are all the same user, so I would like to combine the names into a single entry (as "John Q User"), and combine the counts for each entry to reflect (from the above example) the total count of 14.

Any help would be very much appreciated.

Re: How do I consolidate the values returned from a database query into a single entry?

richgalloway — Wed, 03 Jun 2015 15:11:35 GMT

Is there another field (like email address) available from the database that would link common entries?

Re: How do I consolidate the values returned from a database query into a single entry?

edpeyregne — Wed, 03 Jun 2015 15:13:12 GMT

Unfortunately, no.

Re: How do I consolidate the values returned from a database query into a single entry?

edpeyregne — Wed, 03 Jun 2015 15:16:39 GMT

I finally found this in another post"

http://answers.splunk.com/answers/61646/combining-multivalues-together-inside-a-field.html

Thanks for the response Rich!