Splunk Search

Generate value of a field corresponding to duplicate value of other field

nikita012
New Member

I have 3 columns in my data.

Minutes Store_ID
10 81165
20 80234
30 81165
40 80234
50 82345

I wish to generate a table in the below format.

Store_ID Count Minutes
81165 2 10,30
80234 2 20,40
82345 1 50

The count corresponds to no. of appearances of the store_ID and minutes as a grouping of minutes it took.

Can you please provide code for this data.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@nikita012

Can you please try this?

YOUR_SEARCH | stats delim="," values(Minutes) as Minutes count as Count by Store_ID | mvcombine Minutes

Sample Search:

| makeresults | eval _raw="Minutes Store_ID
10 81165
20 80234
30 81165
40 80234
50 82345" | multikv | table Minutes Store_ID | stats delim="," values(Minutes) as Minutes count as Count by Store_ID | mvcombine Minutes

Thanks

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

 Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research Team (STRT) and ...