Filter splunk results into a List

[kirti_gupta12]

I have a Splunk query that parses the msg field, fetches the fields from the result and displays them in a table. PFA 

Now, the issue is, each field in the row has a unique time, but more than 1 row could have the same fields, except the time as shown in attached file. 

Can we enhance the query in a way, that if for more than 1 row, the fields are same except time, then we can have just row with those fields, and times can as be added as a list (separated by commas) to that final row. 

Example, if 2 rows are

Value1, time1, Value2, Value3
Value1, time2, Value2, Value3

Then it could be represented as

Value1, {time1, time2},  Value 2, Value3

This would reduce the space the 2 (or more than 2) rows take on the Dashboard page. 

Here is the existing query: 

index=myIndex "ERROR * ---" "taskExecutor-*" 
|  rex field=msg "^(?<Time>\S+\s+\S+)\s+\S+\s+(?<Error_Code>\d+)[^\]]+\]\s+(?<Service_Name>\S+)\s+:\s+(?<Error_Message>.+)"
| table Error_Message Error_Code Service_Name Time
| eventstats count as Count by Error_Message Error_Code Service_Name 
| sort -Count

Any help would be appreciated. 

[scelikok · Accepted solution]

Hi @kirti_gupta12,

You can try with values() function like below;

index=myIndex "ERROR * ---" "taskExecutor-*" 
|  rex field=msg "^(?<Time>\S+\s+\S+)\s+\S+\s+(?<Error_Code>\d+)[^\]]+\]\s+(?<Service_Name>\S+)\s+:\s+(?<Error_Message>.+)"
| table Error_Message Error_Code Service_Name Time
| stats count as Count values(Time) as Time by Error_Message Error_Code Service_Name 
| sort -Count