Splunk Search

Combine the results of a table in one single row

nandhiniG
Explorer

I have a splunk query that results in a table , while creating alert it just sends the first row of the results ,so we are missing the remaining results. Inorder to address this , i wanted to combine the results in one row or a message to be sent.

QUERY:

 

 

| inputlookup gtsnet.csv | fields "dataset_name" | search NOT [search index = asvdataintegration source=piedpiper sts_asvdataintegration_symphony_lambda_clewriter_events | search event.proc_stat_cd = "SCSS"  AND   event.evt_dtl.EventDesc = "workflow_found" AND event.module_response.requester = "_SUCCESS" AND event.s3_location = "*"s3://cof-data-*/"*"/lake/gtsnet*"*"  AND "event.module_name"=LAMBDA  | rename event.regrd_dataset_nm as dataset_name | table dataset_name | format]

 

 

 

Current Format:

nandhiniG_0-1631025352208.png

 

Expected Format:

nandhiniG_1-1631025499856.png

 

Labels (5)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| stats list(dataset_name) as dataset_name

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| stats list(dataset_name) as dataset_name

nandhiniG
Explorer

Thanks a lot it worked!!!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...