Splunk Search

Combine 2 values of multi value fields


Hi, I am looking to merge 2 values of a multi valued fields and put it in a table. For example my current query is extracting data like this -

  1. Business Exception while rescheduling order 1103
  2. ICOMS Business Exception. 1103
  3. Business Exception 665

Now if you see 1st and 2nd row are actually same event because the description tag which i am extracting comes twice sometimes.
I have tried combining them using mvcombine and nomv but then how would i extract _time fields as well.
Query -

index=my_prod source="/var/log/test.txt" mywebservice (error OR exception OR critical OR failure)
| rex field=_raw "description>(?[^<]+)" max_match=2
| stats count by Exception
| sort - count
| mvcombine delim=" | " Exception
| nomv Exception

What i want to do is also add _time field in the table and that event should come as a single row with count as 1.

Let me know if someone can help.

0 Karma

Ultra Champion
| stats  min(_time) as _time values(Exception) as Exception
| eval Exception=mvjoin(Exception,"|")

please use code sample and check your post.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...