Splunk Search

Combine 2 values of multi value fields

Shashank_87
Explorer

Hi, I am looking to merge 2 values of a multi valued fields and put it in a table. For example my current query is extracting data like this -

  1. Business Exception while rescheduling order 1103
  2. ICOMS Business Exception. 1103
  3. Business Exception 665

Now if you see 1st and 2nd row are actually same event because the description tag which i am extracting comes twice sometimes.
I have tried combining them using mvcombine and nomv but then how would i extract _time fields as well.
Query -

index=my_prod source="/var/log/test.txt" mywebservice (error OR exception OR critical OR failure)
| rex field=_raw "description>(?[^<]+)" max_match=2
| stats count by Exception
| sort - count
| mvcombine delim=" | " Exception
| nomv Exception

What i want to do is also add _time field in the table and that event should come as a single row with count as 1.

Let me know if someone can help.

0 Karma

to4kawa
Ultra Champion
...
| stats  min(_time) as _time values(Exception) as Exception
| eval Exception=mvjoin(Exception,"|")

please use code sample and check your post.

0 Karma
Get Updates on the Splunk Community!

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...

Getting Started with Splunk Artificial Intelligence, Insights for Nonprofits, and ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...