Splunk Search

Aggregate the column data

bharat149
Explorer

i have a query that show the data in table form i have to merge the row

Query :
my search query |
| timechart span=5m count by message
| eval time=strftime(_time,"%Y-%m-%d %H:%M:%S")
|untable time message count | xyseries message time count

It gives the date in a table form
message time1 time2 time3
a/b/c 1 2 3
abc/1/x 0 1 4
abc/2/x 0 1 2
abc/3/x 0 2 4

i have to merge the row and change the metric to

message time1 time2 time3
a/b/c 1 2 3
abc/x 0 4 10

i have tried rex expression also but i didn't work

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

It would help to know the rex command you tried. Perhaps this will work for you.

my search query |
| rex mode=sed field=message "s'abc/.*'abc/x'"
| timechart span=5m count by message
| eval time=strftime(_time,"%Y-%m-%d %H:%M:%S")
|untable time message count | xyseries message time count
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...