Splunk Search

Combining similar results

FraserC1
Path Finder

If I have the below results:

server_name secondary_id
server1 KB4571703
server1 KB4570508
server1 KB4566425
server2 KB4578013
server3 KB4569751
server3 KB4561600
server3 KB4565351
server4 KB4571703
server4 KB4570508

I would like to combine all instances of "server_name" into one row. Similar to below:

server_name secondary_id
server1 KB4571703
                 KB4570508
                 KB4566425
server2 KB4578013
server3 KB4569751
                 KB4561600
                 KB4565351
server4 KB4571703
                 KB4570508

Any ideas on how this could be achieved?

0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

You can try

...
| stats values(secondary_id) as secondary_id by server_name
| table server_name secondary_id

r. Ismo 

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

You can try

...
| stats values(secondary_id) as secondary_id by server_name
| table server_name secondary_id

r. Ismo 

FraserC1
Path Finder

Hi @isoutamo ,

Thanks for this, that's given me exactly what I was looking for!

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...