I have a Splunk query that parses the msg field, fetches the fields from the result and displays them in a table. PFA
Now, the issue is, each field in the row has a unique time, but more than 1 row could have the same fields, except the time as shown in attached file.
Can we enhance the query in a way, that if for more than 1 row, the fields are same except time, then we can have just row with those fields, and times can as be added as a list (separated by commas) to that final row.
Example, if 2 rows are
Value1, time1, Value2, Value3
Value1, time2, Value2, Value3
Then it could be represented as
Value1, {time1, time2}, Value 2, Value3
This would reduce the space the 2 (or more than 2) rows take on the Dashboard page.
Here is the existing query:
index=myIndex "ERROR * ---" "taskExecutor-*"
| rex field=msg "^(?<Time>\S+\s+\S+)\s+\S+\s+(?<Error_Code>\d+)[^\]]+\]\s+(?<Service_Name>\S+)\s+:\s+(?<Error_Message>.+)"
| table Error_Message Error_Code Service_Name Time
| eventstats count as Count by Error_Message Error_Code Service_Name
| sort -Count
Any help would be appreciated.
Hi @kirti_gupta12,
You can try with values() function like below;
index=myIndex "ERROR * ---" "taskExecutor-*"
| rex field=msg "^(?<Time>\S+\s+\S+)\s+\S+\s+(?<Error_Code>\d+)[^\]]+\]\s+(?<Service_Name>\S+)\s+:\s+(?<Error_Message>.+)"
| table Error_Message Error_Code Service_Name Time
| stats count as Count values(Time) as Time by Error_Message Error_Code Service_Name
| sort -Count
Hi @kirti_gupta12,
You can try with values() function like below;
index=myIndex "ERROR * ---" "taskExecutor-*"
| rex field=msg "^(?<Time>\S+\s+\S+)\s+\S+\s+(?<Error_Code>\d+)[^\]]+\]\s+(?<Service_Name>\S+)\s+:\s+(?<Error_Message>.+)"
| table Error_Message Error_Code Service_Name Time
| stats count as Count values(Time) as Time by Error_Message Error_Code Service_Name
| sort -Count