Splunk Search

Aggregate the column data

Engager

i have a query that show the data in table form i have to merge the row

Query :
my search query |
| timechart span=5m count by message
| eval time=strftime(_time,"%Y-%m-%d %H:%M:%S")
|untable time message count | xyseries message time count

It gives the date in a table form
message time1 time2 time3
a/b/c 1 2 3
abc/1/x 0 1 4
abc/2/x 0 1 2
abc/3/x 0 2 4

i have to merge the row and change the metric to

message time1 time2 time3
a/b/c 1 2 3
abc/x 0 4 10

i have tried rex expression also but i didn't work

Labels (3)
0 Karma

SplunkTrust
SplunkTrust

It would help to know the rex command you tried. Perhaps this will work for you.

my search query |
| rex mode=sed field=message "s'abc/.*'abc/x'"
| timechart span=5m count by message
| eval time=strftime(_time,"%Y-%m-%d %H:%M:%S")
|untable time message count | xyseries message time count
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!