Need help with Splunk query

[Mrig342]

Hi,

I have created  the below table using the query "index=main host="abcde" | rex field=_raw "(?ms)Label\s+Name\s:\s(?<App_Name>\w+\S+)" | rex field=_raw "(?ms)Sync\sState\s:\s(?<App_State>[\w\s]+\w)\s+Number" | table App_Name,App_State"

App_Name    App_State

abc                    Stopped

cde                    Running

abc                    Running

xyz                    Stopped

the                    Running

abc                   Partially running

abc                   Stopped

xyz                    Running

the                    Running

abc                   Running

and so on.

Here I want to create the table in the below format(the app_state should not repeat for a particular app_name but should be shown once per app_name):

App_Name    App_State

abc                    Running

abc                    Partially running

abc                    Stopped

cde                    Running

xyz                    Running

xyz                    Stopped

the                    Running

I used the "dedup" command along with my above query "index=main host="abcde" | rex field=_raw "(?ms)Label\s+Name\s:\s(?<App_Name>\w+\S+)" | rex field=_raw "(?ms)Sync\sState\s:\s(?<App_State>[\w\s]+\w)\s+Number" | table App_Name,App_State | dedup App_Name"

But I am getting this below output:

App_Name    App_State

abc                    Running

cde                    Running

xyz                    Running

the                    Running

Please help me create the query to get the output in the desired way.

Thank you.

[493669 · Accepted solution]

@Mrig342  Try below

...|stats values(App_State) as App_State by App_Name|mvexpand App_State

[Mrig342]

Hi 493669,

Thank you for the prompt response. It worked...!!

Your support is much appreciated...!!

[to4kawa]

| makeresults
| eval _raw="App_Name    App_State
abc                    Stopped
cde                    Running
abc                    Running
xyz                    Stopped
the                    Running
abc                   Partially running
abc                   Stopped
xyz                    Running
the                    Running
abc                   Running"
| multikv forceheader=1 
| table App_*
| reverse
| sort App_Name
| dedup App_Name App_State