Splunk Search

Filter splunk results into a List

kirti_gupta12
Path Finder

I have a Splunk query that parses the msg field, fetches the fields from the result and displays them in a table. PFA 

Now, the issue is, each field in the row has a unique time, but more than 1 row could have the same fields, except the time as shown in attached file. 

Can we enhance the query in a way, that if for more than 1 row, the fields are same except time, then we can have just row with those fields, and times can as be added as a list (separated by commas) to that final row. 

Example, if 2 rows are

 

Value1, time1, Value2, Value3
Value1, time2, Value2, Value3

 

Then it could be represented as

 

Value1, {time1, time2},  Value 2, Value3

 

This would reduce the space the 2 (or more than 2) rows take on the Dashboard page. 

Here is the existing query: 

 

index=myIndex "ERROR * ---" "taskExecutor-*" 
|  rex field=msg "^(?<Time>\S+\s+\S+)\s+\S+\s+(?<Error_Code>\d+)[^\]]+\]\s+(?<Service_Name>\S+)\s+:\s+(?<Error_Message>.+)"
| table Error_Message Error_Code Service_Name Time
| eventstats count as Count by Error_Message Error_Code Service_Name 
| sort -Count

 

Any help would be appreciated. 

Labels (5)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @kirti_gupta12,

You can try with values() function like below;

index=myIndex "ERROR * ---" "taskExecutor-*" 
|  rex field=msg "^(?<Time>\S+\s+\S+)\s+\S+\s+(?<Error_Code>\d+)[^\]]+\]\s+(?<Service_Name>\S+)\s+:\s+(?<Error_Message>.+)"
| table Error_Message Error_Code Service_Name Time
| stats count as Count values(Time) as Time by Error_Message Error_Code Service_Name 
| sort -Count
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @kirti_gupta12,

You can try with values() function like below;

index=myIndex "ERROR * ---" "taskExecutor-*" 
|  rex field=msg "^(?<Time>\S+\s+\S+)\s+\S+\s+(?<Error_Code>\d+)[^\]]+\]\s+(?<Service_Name>\S+)\s+:\s+(?<Error_Message>.+)"
| table Error_Message Error_Code Service_Name Time
| stats count as Count values(Time) as Time by Error_Message Error_Code Service_Name 
| sort -Count
If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...