Need help with Splunk Query

[nilbak1]

Hello Splunkers,

I need help with below scenario:

I need to form query from xml log in below format.

TransactionID            LineNumber            Fulfiller
123                                        1                             abc
124                                         1                            xyz
125                                         1                            def
                                                  2                           xyz
126                                          1                           abc
                                                   2                           def
                                                   3                            xyz

So, here in my xml logs sometime i am having only one LineNumber mentioned and correspondingly fulfiller.
However, in some log events i am having multiple LineNumbers with corresponding fulfillers for same transactionid.

I have used regex to extract transactionid, LineNumber and fullfiller name.

I want result in above format.
Hope I am able to explain my scenario.

[nilbak1]

After using max_match in regex and running below query

my Query | stats values(LineNumber) as LineNumber values(Fullfiller) by TransactionID

I am getting as below result 

10000056090658 1 abc
10000063819764 1 xyz
                                        2
10000063819784 1 abc
                                        2 def

10000063820877 1 abc
                                        2
Not getting fulfillers with some of the line numbers.

[thambisetty · Accepted solution]

Try below,

my Query | stats list(LineNumber) as LineNumber list(Fullfiller) by TransactionID

values function displays only distinct values.

where as list displays linenumber and its fulfiller by transactionID

[nilbak1]

Thanks @thambisetty 

Yes, I used list function and it worked, got the results as required.

Anyways thanks for your reply.

[thambisetty]

Happy I solved your problem. Please like answer.

[Nisha18789]

hi @nilbak1 , can you share the regex you are using ? Or the log?