Combine table rows

lgroot — Thu, 24 Sep 2015 10:27:21 GMT

Hi everyone,

I've got a question about a query i have made:

index=security-mijnssp "View rendered = /error.jspx" OR "Er is een fout opgetreden op de JSF pagina"  | rex "BSN=(?P<BSN>[^<]+) View" | rex "INFO  n.s.m.w.l(?P<INFO>[^<]+)"|rex "ERROR n.s.m.w.l(?P<ERROR>[^<]+)"|  table INFO,BSN, ERROR, _time

Is it possible to combine the results of this query in one row?
So that the INFO,BSN,ERROR and time are in one row?

Re: Combine table rows

somesoni2 — Thu, 24 Sep 2015 15:05:17 GMT

You would be able to combine this if they have a common field that can correlate them. From the example/screenshot, only common field I can see is _time, so my answer is based on _time, change the field if there are any other common fields.

Update
Actually BSN is the common field, so updating it to BSN

 index=security-mijnssp "View rendered = /error.jspx" OR "Er is een fout opgetreden op de JSF pagina"  | rex "BSN=(?P<BSN>[^<]+) View" | rex "INFO  n.s.m.w.l(?P<INFO>[^<]+)"|rex "ERROR n.s.m.w.l(?P<ERROR>[^<]+)"|  table INFO,BSN, ERROR, _time |stats values(*) as * by BSN

topic Combine table rows in Splunk Search

Combine table rows

Re: Combine table rows