Splunk Search

Combine 2 values of multi value fields


Hi, I am looking to merge 2 values of a multi valued fields and put it in a table. For example my current query is extracting data like this -

  1. Business Exception while rescheduling order 1103
  2. ICOMS Business Exception. 1103
  3. Business Exception 665

Now if you see 1st and 2nd row are actually same event because the description tag which i am extracting comes twice sometimes.
I have tried combining them using mvcombine and nomv but then how would i extract _time fields as well.
Query -

index=my_prod source="/var/log/test.txt" mywebservice (error OR exception OR critical OR failure)
| rex field=_raw "description>(?[^<]+)" max_match=2
| stats count by Exception
| sort - count
| mvcombine delim=" | " Exception
| nomv Exception

What i want to do is also add _time field in the table and that event should come as a single row with count as 1.

Let me know if someone can help.

0 Karma

Ultra Champion
| stats  min(_time) as _time values(Exception) as Exception
| eval Exception=mvjoin(Exception,"|")

please use code sample and check your post.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...