Splunk Search

Filter splunk results into a List

kirti_gupta12
Path Finder

I have a Splunk query that parses the msg field, fetches the fields from the result and displays them in a table. PFA 

Now, the issue is, each field in the row has a unique time, but more than 1 row could have the same fields, except the time as shown in attached file. 

Can we enhance the query in a way, that if for more than 1 row, the fields are same except time, then we can have just row with those fields, and times can as be added as a list (separated by commas) to that final row. 

Example, if 2 rows are

 

Value1, time1, Value2, Value3
Value1, time2, Value2, Value3

 

Then it could be represented as

 

Value1, {time1, time2},  Value 2, Value3

 

This would reduce the space the 2 (or more than 2) rows take on the Dashboard page. 

Here is the existing query: 

 

index=myIndex "ERROR * ---" "taskExecutor-*" 
|  rex field=msg "^(?<Time>\S+\s+\S+)\s+\S+\s+(?<Error_Code>\d+)[^\]]+\]\s+(?<Service_Name>\S+)\s+:\s+(?<Error_Message>.+)"
| table Error_Message Error_Code Service_Name Time
| eventstats count as Count by Error_Message Error_Code Service_Name 
| sort -Count

 

Any help would be appreciated. 

Labels (5)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @kirti_gupta12,

You can try with values() function like below;

index=myIndex "ERROR * ---" "taskExecutor-*" 
|  rex field=msg "^(?<Time>\S+\s+\S+)\s+\S+\s+(?<Error_Code>\d+)[^\]]+\]\s+(?<Service_Name>\S+)\s+:\s+(?<Error_Message>.+)"
| table Error_Message Error_Code Service_Name Time
| stats count as Count values(Time) as Time by Error_Message Error_Code Service_Name 
| sort -Count
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @kirti_gupta12,

You can try with values() function like below;

index=myIndex "ERROR * ---" "taskExecutor-*" 
|  rex field=msg "^(?<Time>\S+\s+\S+)\s+\S+\s+(?<Error_Code>\d+)[^\]]+\]\s+(?<Service_Name>\S+)\s+:\s+(?<Error_Message>.+)"
| table Error_Message Error_Code Service_Name Time
| stats count as Count values(Time) as Time by Error_Message Error_Code Service_Name 
| sort -Count
If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...