Group results by field

[zamkov]

I am trying to group a set of results by a field. I'd like to do this using a table, but don't think its possible. Similar questions use stat, but whenever a field wraps onto the next line, the fields of a single event no longer line up in one row.

My data:
jobid, created, msg, filename

Currently, I have jobid>300 | sort created | stats latest(created) as last list(created) list(msg) list(filename) by jobid | sort last | fields - last
But when msg wraps onto the next line, the msg's no longer line up with the correct timestamp.

ex.

[sundareshr]

Try this

jobid>300 |streamstats latest(created) as last by jobid | table last, created, msg, filename

[thirumalreddyb]

| stats latest(created) as last, list(msg), list(filename) by jobid, created | sort last | fields - last

This should solve your problem.

[zamkov]

Actually this doesn't seem to work even without real-time search - the results are displayed by time and not grouped by jobid at all.

[zamkov]

This is close, but when I use this in a real-time search, the results no longer stayed grouped by jobid. ie. if I get a message for jobid 100 then 200 then 100, it will be displayed
100 ....
200 ...
100 ...

The original search would display it as
200 ...
100 ...
100 ....

Is there a way to keep it grouped by jobid with real-time results?