topic How to use eval min and mvcombine ip for events grouped by two or three other fields? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-use-eval-min-and-mvcombine-ip-for-events-grouped-by-two/m-p/189712#M54634 <P>Hello! <BR /> How can I, for example, eval min(_time) an mvcombine ip for event grouped by two or three other fields?<BR /> Thank you in advance!</P> Thu, 21 Aug 2014 09:23:29 GMT 0range 2014-08-21T09:23:29Z How to use eval min and mvcombine ip for events grouped by two or three other fields? https://community.splunk.com/t5/Splunk-Search/How-to-use-eval-min-and-mvcombine-ip-for-events-grouped-by-two/m-p/189712#M54634 <P>Hello! <BR /> How can I, for example, eval min(_time) an mvcombine ip for event grouped by two or three other fields?<BR /> Thank you in advance!</P> Thu, 21 Aug 2014 09:23:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-eval-min-and-mvcombine-ip-for-events-grouped-by-two/m-p/189712#M54634 0range 2014-08-21T09:23:29Z Re: How to use eval min and mvcombine ip for events grouped by two or three other fields? https://community.splunk.com/t5/Splunk-Search/How-to-use-eval-min-and-mvcombine-ip-for-events-grouped-by-two/m-p/189713#M54635 <P>try this</P> <PRE><CODE>Some search terms | eventstats min(_time) as MinTime by Field_1, Field_2| mvcombine IP_Addr </CODE></PRE> <P>If you intention is to combine multivalue field among a group of identical events, see this also</P> <PRE><CODE>Some search terms | stats min(_time) as "Min Time", values(Ip_addr) as "IP Addresses" by Field_1, Field_2 </CODE></PRE> Thu, 21 Aug 2014 10:54:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-eval-min-and-mvcombine-ip-for-events-grouped-by-two/m-p/189713#M54635 strive 2014-08-21T10:54:36Z