Splunk Search

Combine the results of a table in one single row

nandhiniG
Explorer

I have a splunk query that results in a table , while creating alert it just sends the first row of the results ,so we are missing the remaining results. Inorder to address this , i wanted to combine the results in one row or a message to be sent.

QUERY:

 

 

| inputlookup gtsnet.csv | fields "dataset_name" | search NOT [search index = asvdataintegration source=piedpiper sts_asvdataintegration_symphony_lambda_clewriter_events | search event.proc_stat_cd = "SCSS"  AND   event.evt_dtl.EventDesc = "workflow_found" AND event.module_response.requester = "_SUCCESS" AND event.s3_location = "*"s3://cof-data-*/"*"/lake/gtsnet*"*"  AND "event.module_name"=LAMBDA  | rename event.regrd_dataset_nm as dataset_name | table dataset_name | format]

 

 

 

Current Format:

nandhiniG_0-1631025352208.png

 

Expected Format:

nandhiniG_1-1631025499856.png

 

Labels (5)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| stats list(dataset_name) as dataset_name

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| stats list(dataset_name) as dataset_name

nandhiniG
Explorer

Thanks a lot it worked!!!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...