https://community.splunk.com/t5/Splunk-Search/How-to-merge-2-messages-into-1-message/m-p/227421#M67165 <P>No, there are none! I was thinking it might be -- take if the first row contains "TestingData" (else first row is set to "NA") and then merge with the next row if it contains "TestingCompleted" (else if second row is missing then set to "NA"), so it would be more like a row count type of thing instead of anything solid like an id field ... but I'm not sure if that's the best way. </P> <P>And I'm not sure how to accomplish the above either, so any help is appreciated. Thanks!</P> Wed, 02 Mar 2016 21:33:52 GMT ceng 2016-03-02T21:33:52Z https://community.splunk.com/t5/Splunk-Search/How-to-merge-2-messages-into-1-message/m-p/227419#M67163 <P>Hi,</P> <P>Is there a way to merge 2 messages into 1 message? For example I have a sequence of messages:</P> <PRE><CODE>TestingData numTests=3 TestingCompleted start=10:00am end=3:00pm TestingData numTest=2 TestingCompleted start=11:00am end=1:00pm </CODE></PRE> <P>I would like this to look like below where 1+2 are merged and 3+4 are merged. </P> <PRE><CODE>TestingData numTests=3 start=10:00am end=3:00pm TestingData numTest=2 start=11:00am end=1:00pm </CODE></PRE> <P>If either a TestingData or TestingCompleted row was missing then NA for that element of the merged row. So, if row 1 was missing then we would have below. The msg sequence order is fairly guaranteed. </P> <PRE><CODE>NA start=10:00am end=3:00pm TestingData numTest=2 start=11:00am end=1:00pm </CODE></PRE> <P>Thanks! </P> Wed, 02 Mar 2016 21:14:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-merge-2-messages-into-1-message/m-p/227419#M67163 ceng 2016-03-02T21:14:37Z https://community.splunk.com/t5/Splunk-Search/How-to-merge-2-messages-into-1-message/m-p/227420#M67164 <P>Do your events have any common fields based which they can be merged??</P> Wed, 02 Mar 2016 21:27:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-merge-2-messages-into-1-message/m-p/227420#M67164 somesoni2 2016-03-02T21:27:52Z https://community.splunk.com/t5/Splunk-Search/How-to-merge-2-messages-into-1-message/m-p/227421#M67165 <P>No, there are none! I was thinking it might be -- take if the first row contains "TestingData" (else first row is set to "NA") and then merge with the next row if it contains "TestingCompleted" (else if second row is missing then set to "NA"), so it would be more like a row count type of thing instead of anything solid like an id field ... but I'm not sure if that's the best way. </P> <P>And I'm not sure how to accomplish the above either, so any help is appreciated. Thanks!</P> Wed, 02 Mar 2016 21:33:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-merge-2-messages-into-1-message/m-p/227421#M67165 ceng 2016-03-02T21:33:52Z https://community.splunk.com/t5/Splunk-Search/How-to-merge-2-messages-into-1-message/m-p/227422#M67166 <P>It would be much easier if you were repeating the numTest on each line (to use a common grouping value)</P> <P>You can try to regroup with a transaction at search time.<BR /> see <A href="http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Transaction">http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Transaction</A></P> <P>look at the "startswith" and "endswith" options.</P> Wed, 02 Mar 2016 21:40:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-merge-2-messages-into-1-message/m-p/227422#M67166 yannK 2016-03-02T21:40:04Z https://community.splunk.com/t5/Splunk-Search/How-to-merge-2-messages-into-1-message/m-p/227423#M67167 <P>It works with this, thanks!</P> Wed, 02 Mar 2016 22:15:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-merge-2-messages-into-1-message/m-p/227423#M67167 ceng 2016-03-02T22:15:17Z