topic How to create a table using dedup to show one entry for each application name and create a multivalue field? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-create-a-table-using-dedup-to-show-one-entry-for-each/m-p/221980#M65264 <P>I have events that include an <STRONG>application name</STRONG> field and a <STRONG>uservalue</STRONG> field. </P> <P>When i table the data by <STRONG>application</STRONG> and <STRONG>uservalue</STRONG>, i see each event individually thus meaning i get multiple pages of events with the same application name.</P> <P>How can I have one entry for each <STRONG>application name</STRONG> and a multivalue field showing the <STRONG>uservalues</STRONG>?</P> <P>EG: go from</P> <PRE><CODE>application uservalue app1 123456 app1 234567 app1 345678 app2 987654 app2 876543 app2 765432 </CODE></PRE> <P>and get :</P> <PRE><CODE>application uservalue app1 123456 234567 345678 app2 987654 876543 765432 </CODE></PRE> <P>It's probably something really easy, but I've stepped away from Splunk for awhile and forget even the easy stuff. </P> <P>Thanks</P> Tue, 04 Oct 2016 17:08:48 GMT stuart338 2016-10-04T17:08:48Z How to create a table using dedup to show one entry for each application name and create a multivalue field? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-table-using-dedup-to-show-one-entry-for-each/m-p/221980#M65264 <P>I have events that include an <STRONG>application name</STRONG> field and a <STRONG>uservalue</STRONG> field. </P> <P>When i table the data by <STRONG>application</STRONG> and <STRONG>uservalue</STRONG>, i see each event individually thus meaning i get multiple pages of events with the same application name.</P> <P>How can I have one entry for each <STRONG>application name</STRONG> and a multivalue field showing the <STRONG>uservalues</STRONG>?</P> <P>EG: go from</P> <PRE><CODE>application uservalue app1 123456 app1 234567 app1 345678 app2 987654 app2 876543 app2 765432 </CODE></PRE> <P>and get :</P> <PRE><CODE>application uservalue app1 123456 234567 345678 app2 987654 876543 765432 </CODE></PRE> <P>It's probably something really easy, but I've stepped away from Splunk for awhile and forget even the easy stuff. </P> <P>Thanks</P> Tue, 04 Oct 2016 17:08:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-table-using-dedup-to-show-one-entry-for-each/m-p/221980#M65264 stuart338 2016-10-04T17:08:48Z Re: How to create a table using dedup to show one entry for each application name and create a multivalue field? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-table-using-dedup-to-show-one-entry-for-each/m-p/221981#M65265 <PRE><CODE>source="Workbook1.csv" sourcetype="csv" | stats list(uservalue) as UserValue by application </CODE></PRE> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1936iA716096EA58AC65C/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Tue, 04 Oct 2016 18:00:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-table-using-dedup-to-show-one-entry-for-each/m-p/221981#M65265 dmaislin_splunk 2016-10-04T18:00:35Z Re: How to create a table using dedup to show one entry for each application name and create a multivalue field? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-table-using-dedup-to-show-one-entry-for-each/m-p/221982#M65266 <P>See, i knew it was easy.. Thanks.</P> Tue, 04 Oct 2016 21:25:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-table-using-dedup-to-show-one-entry-for-each/m-p/221982#M65266 stuart338 2016-10-04T21:25:03Z