Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Knowledge Management
- :
- Re: for a data set with a common request ID but da...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
for a data set with a common request ID but data is scattered in different rows but want to get in 1 line for and just 1 row
I have a data like I am searching with a request ID
and I get below data like
time 1: request id=1 account details and elapsed time
time 2 request id=1 account codes
time 3 request id= 1 viewname and view 2
time 1: request id=2 account details and elapsed time
time 2 request id=2 account codes
time 3 request id=2 viewname and view2
I want like the below
request id accountdetails accountcd viewname view2
1 abc abc_cd skyview earthview
2 xyz xyz_cd sky1view earthview1
can you please help how can i achive this , thanks in advance
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Give this a try (adjust the field name per yours)
your base search fetching all 3 type of events
| stats values(account_details) as account_details values(accountcd) as accountcd values(viewname) as viewname values(view2) as view2 by request_id
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
also in above the account details contain more than 1 account details for which need those in it like all ones
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Could you explain this with an example? (what you're getting right now and what you want)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
what to do for date if I want to get along with above columns
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Based on which time you want, you can include max(_time) as _time OR min(_time) as _time in the stats.
Reduce and Transform Your Firewall Data with Splunk Data Management
Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...
Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions
