Combining details from two log entries into one table under common ID

[pitaszek]

Hello Comminity,

Here goes the more detailed descrition

2019-07-12 11:19:55.519 [VDI111][Process1][Info] msg=report;rpt_comment=Installation;rpt_Case_Id=6547456
2019-07-12 11:19:55.519 [VDI111][Process1][Info] msg=report;rpt_comment=Deinstallation;rpt_Case_Id=6547456

I want to create one row i a table where I have:

6547456 | Installation | Deinstallation

I tried search like:

VDI="VDI1" Process="Process1" rpt_comment* | table _time, rpt_Case_Id, rpt_comment

But it does split the rows for the ID

Hope you can come up with some idea.

Cheers,
W

[richgalloway]

This search will create a single row for each ID, but you will have multiple values in each cell.

VDI="VDI1" Process="Process1" rpt_comment* 
| stats values(_time) as _time, values(rpt_comment) as rpt_comment by rpt_Case_Id 
| table _time, rpt_Case_Id, rpt_comment