Splunk Search

Grouping the data row based

rsathish47
Contributor

HI All,

I need to group the data row based my table looks like this.

Table:

DBName Region Dag count

DB1 US DG1 3

DB1 EUR DG1 5

DB2 US DG3 4

DB3 EUR DG2 5

DB3 US DG2 3

DB3 Ap DG2 6

Result Table

DBName Region Dag count

DB1 US,EUR DG1,DG1 3,5

DB2 US DG3 4

DB3 EUR,US,Ap DG2,DB2,DB2 5,6,3

Please let me know if their any workaround

Thanks
Sathish R

Tags (1)
0 Karma

somesoni2
Revered Legend

Similar, but formatted as per your example:

..your base search...| stats delim="," values(Region) as Region values(Dag) as Dag values(count) as count by DBName | nomv Region | nomv Dag | nomv count
0 Karma

adityapavan18
Contributor

Could you try like

| stats values(Region) as Region values(Dag) as Dag values(count) as count by DBName.

you can also use list instead of values.

0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...