Splunk Search

Combining similar results

FraserC1
Path Finder

If I have the below results:

server_name secondary_id
server1 KB4571703
server1 KB4570508
server1 KB4566425
server2 KB4578013
server3 KB4569751
server3 KB4561600
server3 KB4565351
server4 KB4571703
server4 KB4570508

I would like to combine all instances of "server_name" into one row. Similar to below:

server_name secondary_id
server1 KB4571703
                 KB4570508
                 KB4566425
server2 KB4578013
server3 KB4569751
                 KB4561600
                 KB4565351
server4 KB4571703
                 KB4570508

Any ideas on how this could be achieved?

0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

You can try

...
| stats values(secondary_id) as secondary_id by server_name
| table server_name secondary_id

r. Ismo 

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

You can try

...
| stats values(secondary_id) as secondary_id by server_name
| table server_name secondary_id

r. Ismo 

FraserC1
Path Finder

Hi @isoutamo ,

Thanks for this, that's given me exactly what I was looking for!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...