Aggregate the column data

[bharat149]

i have a query that show the data in table form i have to merge the row

Query :
my search query |
| timechart span=5m count by message
| eval time=strftime(_time,"%Y-%m-%d %H:%M:%S")
|untable time message count | xyseries message time count

It gives the date in a table form
message time1 time2 time3
a/b/c 1 2 3
abc/1/x 0 1 4
abc/2/x 0 1 2
abc/3/x 0 2 4

i have to merge the row and change the metric to

message time1 time2 time3
a/b/c 1 2 3
abc/x 0 4 10

i have tried rex expression also but i didn't work

[richgalloway]

It would help to know the rex command you tried. Perhaps this will work for you.

my search query |
| rex mode=sed field=message "s'abc/.*'abc/x'"
| timechart span=5m count by message
| eval time=strftime(_time,"%Y-%m-%d %H:%M:%S")
|untable time message count | xyseries message time count