https://community.splunk.com/t5/Splunk-Search/How-to-extract-unique-values-from-events-with-multiple-values/m-p/243411#M72440 <P>Like this</P> <PRE><CODE>base search here | extract pairdelim="," kvdelim="=" | eval {message}=varValue | table _time Tower Platform City SessionID </CODE></PRE> Wed, 24 Aug 2016 01:29:20 GMT sundareshr 2016-08-24T01:29:20Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-unique-values-from-events-with-multiple-values/m-p/243408#M72437 <P>I am importing SQL data into Splunk.<BR /> Each record contains <STRONG>SessionID</STRONG>, <STRONG>message</STRONG>, and <STRONG>VarValue</STRONG>.</P> <P>SessionID is always unique, but message and VarValue contain different values</P> <P>Example</P> <P>Sessionid = 1234,message="Tower", varValue="site1"<BR /> SessionID = 1234,message="Platform",varValue="Wireless"<BR /> SessionID = 1234,message="City",varValue="mytown"</P> <P>Sessionid = 2222,message="Tower", varValue="site2"<BR /> SessionID = 2222,message="Platform",varValue="Satellite"<BR /> SessionID = 2222,message="City",varValue="mytown"</P> <P>How can I extract the unique message and varValue into separate variables per unique SessionID?</P> <P>What I would like to do is display the Platform and City within a single search</P> Tue, 23 Aug 2016 19:32:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-unique-values-from-events-with-multiple-values/m-p/243408#M72437 ipops 2016-08-23T19:32:44Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-unique-values-from-events-with-multiple-values/m-p/243409#M72438 <P>If the data is already in Splunk, and the three fields have been extracted, see if this works (may need some tweaking)</P> <PRE><CODE>base search here | eval {message}=varValue | stats values(Tower) as Tower values(Platform) as Platform values(City) as City by SessionID </CODE></PRE> <P>If the fields are not extracted, try this</P> <PRE><CODE>base search here | extract pairdelim="," kvdelim="=" | eval {message}=varValue | stats values(Tower) as Tower values(Platform) as Platform values(City) as City by SessionID </CODE></PRE> Tue, 23 Aug 2016 19:53:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-unique-values-from-events-with-multiple-values/m-p/243409#M72438 sundareshr 2016-08-23T19:53:11Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-unique-values-from-events-with-multiple-values/m-p/243410#M72439 <P>That worked. Thanks alot!</P> <P>Only thing is no timestamps are shown when I do the following. Any ideas how to get timestamps?</P> <PRE><CODE>base search here | extract pairdelim="," kvdelim="=" | eval {message}=varValue | stats values(Tower) as Tower values(Platform) as Platform values(City) as City by SessionID | table _time Tower Platform City SessionID </CODE></PRE> Tue, 23 Aug 2016 20:35:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-unique-values-from-events-with-multiple-values/m-p/243410#M72439 ipops 2016-08-23T20:35:35Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-unique-values-from-events-with-multiple-values/m-p/243411#M72440 <P>Like this</P> <PRE><CODE>base search here | extract pairdelim="," kvdelim="=" | eval {message}=varValue | table _time Tower Platform City SessionID </CODE></PRE> Wed, 24 Aug 2016 01:29:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-unique-values-from-events-with-multiple-values/m-p/243411#M72440 sundareshr 2016-08-24T01:29:20Z