topic Re: Merge Lines Query based on ID in Splunk Search

Merge Lines Query based on ID

mnorindr — Fri, 08 Aug 2014 12:52:27 GMT

Hello,

I would like to merge 2 lines which an ID is the unique Key.
Ex

Username      Date         ID        
   Max                    1702
             08/08/14     1702

and get just one line base on the unique ID

Username      Date         ID
   Max       08/08/14     1702

Is it possible to do that?
I though that the command merge can help but do not success

Thanks for your help

Re: Merge Lines Query based on ID

somesoni2 — Fri, 08 Aug 2014 13:00:27 GMT

Try something like this

your base search | table Username Date ID | stats first(*) as * by ID

Re: Merge Lines Query based on ID

mnorindr — Mon, 11 Aug 2014 11:41:58 GMT

Just try but doesn't work (No results found). I see in the forum that maybe "transaction" command can help, i'll try

Re: Merge Lines Query based on ID

rhys04 — Sat, 30 Jan 2016 01:06:22 GMT

I'm on Splunk 6.3 and there's a dedup command you can use in the search for this purpose.
your base search | dedup ID order by username desc

Is there a way apply this logic upon ingestion as opposed to search?

Re: Merge Lines Query based on ID

rakeshh123 — Mon, 01 Feb 2016 11:50:28 GMT

Hi mnorindr,
It can be solved by using Transaction......according to data u got 2lines having redundant data ....for example sessionid may remain same for a particular transaction

this can be solved by using Transaction query

Re: Merge Lines Query based on ID

marhuc — Thu, 01 Feb 2018 12:24:31 GMT

I have similar problem, I tried this approach and it works fine