Splunk Search

How to group togeher the rows based on some field value in splunk

disha
Contributor

I am having a search in my view code and displaying results in the form of table.
small example result:
custid Eventid
10001 200
10001 300
10002 200
10002 100
10002 300

This time each line is coming in each row. Can we group together the same custid with different values on eventid as one row like

        custID   eventid

first row ->10001 200
300
second row->10002 200
100
300

Is there is any way to do that.
Thanks

Tags (1)
1 Solution

_d_
Splunk Employee
Splunk Employee

Try these:

...my search here... | stats list(custID) by eventID

or, if you want unique custID:

...my search here... | stats values(custID) by eventID

Hope this helps,

d.

View solution in original post

_d_
Splunk Employee
Splunk Employee

Try these:

...my search here... | stats list(custID) by eventID

or, if you want unique custID:

...my search here... | stats values(custID) by eventID

Hope this helps,

d.

unitedmarsupial
Path Finder

Just wanted to add, that those, who want all of their fields to be grouped, can use the asterisk -- instead of painstakingly enumerating them all (and then re-enumerating, when the field-set changes).

This works for all regular fields -- but not for the special ones (like _time), those still must be listed explicitly:

| stats values(*), values(_time), values(_raw) by eventID

 

0 Karma

gokulakrishnans
Explorer

This query "stats values(custID) by eventID" worked for me. Over here, how to count the list of custID's and display it in a table?

0 Karma

disha
Contributor

Thanks. this thing worked. I need to show some more columns so i just added like
|stats list(eventid), list(time), list(description) by custid

vsingla1
Communicator

After grouping the fields into one list, how do I make this list comma separated?

unitedmarsupial
Path Finder

@vsingla1 wrote:

After grouping the fields into one list, how do I make this list comma separated?


This is, what I have somewhere already -- the field Mnemonic (singular), specific to every event, is grouped into Mnemonics (plural), which is then passed to multi-value join:

| eventstats values(Mnemonic) as Mnemonics
| eval Mnemonics=mvjoin(Mnemonics, ",")

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...