Splunk Search

Filter splunk results into a List

kirti_gupta12
Path Finder

I have a Splunk query that parses the msg field, fetches the fields from the result and displays them in a table. PFA 

Now, the issue is, each field in the row has a unique time, but more than 1 row could have the same fields, except the time as shown in attached file. 

Can we enhance the query in a way, that if for more than 1 row, the fields are same except time, then we can have just row with those fields, and times can as be added as a list (separated by commas) to that final row. 

Example, if 2 rows are

 

Value1, time1, Value2, Value3
Value1, time2, Value2, Value3

 

Then it could be represented as

 

Value1, {time1, time2},  Value 2, Value3

 

This would reduce the space the 2 (or more than 2) rows take on the Dashboard page. 

Here is the existing query: 

 

index=myIndex "ERROR * ---" "taskExecutor-*" 
|  rex field=msg "^(?<Time>\S+\s+\S+)\s+\S+\s+(?<Error_Code>\d+)[^\]]+\]\s+(?<Service_Name>\S+)\s+:\s+(?<Error_Message>.+)"
| table Error_Message Error_Code Service_Name Time
| eventstats count as Count by Error_Message Error_Code Service_Name 
| sort -Count

 

Any help would be appreciated. 

Labels (5)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @kirti_gupta12,

You can try with values() function like below;

index=myIndex "ERROR * ---" "taskExecutor-*" 
|  rex field=msg "^(?<Time>\S+\s+\S+)\s+\S+\s+(?<Error_Code>\d+)[^\]]+\]\s+(?<Service_Name>\S+)\s+:\s+(?<Error_Message>.+)"
| table Error_Message Error_Code Service_Name Time
| stats count as Count values(Time) as Time by Error_Message Error_Code Service_Name 
| sort -Count
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @kirti_gupta12,

You can try with values() function like below;

index=myIndex "ERROR * ---" "taskExecutor-*" 
|  rex field=msg "^(?<Time>\S+\s+\S+)\s+\S+\s+(?<Error_Code>\d+)[^\]]+\]\s+(?<Service_Name>\S+)\s+:\s+(?<Error_Message>.+)"
| table Error_Message Error_Code Service_Name Time
| stats count as Count values(Time) as Time by Error_Message Error_Code Service_Name 
| sort -Count
If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...