Splunk Search

Filter splunk results into a List

kirti_gupta12
Path Finder

I have a Splunk query that parses the msg field, fetches the fields from the result and displays them in a table. PFA 

Now, the issue is, each field in the row has a unique time, but more than 1 row could have the same fields, except the time as shown in attached file. 

Can we enhance the query in a way, that if for more than 1 row, the fields are same except time, then we can have just row with those fields, and times can as be added as a list (separated by commas) to that final row. 

Example, if 2 rows are

 

Value1, time1, Value2, Value3
Value1, time2, Value2, Value3

 

Then it could be represented as

 

Value1, {time1, time2},  Value 2, Value3

 

This would reduce the space the 2 (or more than 2) rows take on the Dashboard page. 

Here is the existing query: 

 

index=myIndex "ERROR * ---" "taskExecutor-*" 
|  rex field=msg "^(?<Time>\S+\s+\S+)\s+\S+\s+(?<Error_Code>\d+)[^\]]+\]\s+(?<Service_Name>\S+)\s+:\s+(?<Error_Message>.+)"
| table Error_Message Error_Code Service_Name Time
| eventstats count as Count by Error_Message Error_Code Service_Name 
| sort -Count

 

Any help would be appreciated. 

Labels (5)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @kirti_gupta12,

You can try with values() function like below;

index=myIndex "ERROR * ---" "taskExecutor-*" 
|  rex field=msg "^(?<Time>\S+\s+\S+)\s+\S+\s+(?<Error_Code>\d+)[^\]]+\]\s+(?<Service_Name>\S+)\s+:\s+(?<Error_Message>.+)"
| table Error_Message Error_Code Service_Name Time
| stats count as Count values(Time) as Time by Error_Message Error_Code Service_Name 
| sort -Count
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @kirti_gupta12,

You can try with values() function like below;

index=myIndex "ERROR * ---" "taskExecutor-*" 
|  rex field=msg "^(?<Time>\S+\s+\S+)\s+\S+\s+(?<Error_Code>\d+)[^\]]+\]\s+(?<Service_Name>\S+)\s+:\s+(?<Error_Message>.+)"
| table Error_Message Error_Code Service_Name Time
| stats count as Count values(Time) as Time by Error_Message Error_Code Service_Name 
| sort -Count
If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...