Splunk Search

Combine the results of a table in one single row

nandhiniG
Explorer

I have a splunk query that results in a table , while creating alert it just sends the first row of the results ,so we are missing the remaining results. Inorder to address this , i wanted to combine the results in one row or a message to be sent.

QUERY:

 

 

| inputlookup gtsnet.csv | fields "dataset_name" | search NOT [search index = asvdataintegration source=piedpiper sts_asvdataintegration_symphony_lambda_clewriter_events | search event.proc_stat_cd = "SCSS"  AND   event.evt_dtl.EventDesc = "workflow_found" AND event.module_response.requester = "_SUCCESS" AND event.s3_location = "*"s3://cof-data-*/"*"/lake/gtsnet*"*"  AND "event.module_name"=LAMBDA  | rename event.regrd_dataset_nm as dataset_name | table dataset_name | format]

 

 

 

Current Format:

nandhiniG_0-1631025352208.png

 

Expected Format:

nandhiniG_1-1631025499856.png

 

Labels (5)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| stats list(dataset_name) as dataset_name

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| stats list(dataset_name) as dataset_name

nandhiniG
Explorer

Thanks a lot it worked!!!

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...