Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Group together different fields found on different...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
I would like to group together different fields found on different lines, based on a common field that is found on all lines.
Example Log Lines
2014-03-25 13:45:38,003 - [123456789] Incoming Search Request: project=Project01
2014-03-25 13:45:38,003 - [123456789] count=456, executionTime=334
2014-03-25 13:47:31,012 - [987654321] Incoming Search Request: project=Project02
2014-03-25 13:47:31,012 - [987654321] count=8784, executionTime=1145
I would like to create a table from these lines that looks like:
| Project | ID | count | executionTime |
|---|---|---|---|
| Project01 | 123456789 | 456 | 334 |
| Project02 | 987654321 | 8784 | 1145 |
Is this possible? The only examples I have found, the values to group are always on every line, where as some of my fields only appear on the first or second line.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this
your base search | transaction ID startswith="project=*" endswith="executionTime=*" | table project, ID, count,executionTime
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this
your base search | transaction ID startswith="project=*" endswith="executionTime=*" | table project, ID, count,executionTime
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Awesome! That worked perfectly. Thank you!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have seen as many as 9 lines for a unique ID, but usually it is only 2 or 3 lines
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
For one ID, is there only two events or there can be more?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Persistent Queue at TcpOut — One of Splunk's Most Practical Features
Catalog Is Now Generally Available on Splunk Cloud Platform
Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner
