Splunk Search

Grouping values

mkrauss1
Explorer

Assume we have the following splunk records:

S=1 T=abcd demoval=hello

T=abcd anotherdemo=anothwerhello

T=abcd lastdemo=lastworld

S=1 is mandatory in the search, this initial record must match.


Question: How would i group the T value/key pair to get S,demoval,anotherdemo
and lastdemo together in the output?

Thanks...

Tags (2)
0 Karma
1 Solution

kaufmanm
Communicator

The transaction command can group these events together into one event based on a common field:

  • | transaction T | table T S demoval anotherdemo lastdemo

Then you can create a table with rows that have the common T values alongside the S, demoval, anotherdemo, and lastdemo values there were previously part of separate events.

http://docs.splunk.com/Documentation/Splunk/6.0.2/SearchReference/Transaction

View solution in original post

0 Karma

mkrauss1
Explorer

Thanks.
There is one point missing - the initial S=* condition.

Another sample:

S=1 T=abcd demoval=hello

S=xx T=abcd anotherdemo=anothwerhello

S=YY T=abcd lastdemo=lastworld

The T key value should be grouped while the initial search condition must start with S=1

followed
by any other values (xx or yy)

0 Karma

kaufmanm
Communicator

The transaction command can group these events together into one event based on a common field:

  • | transaction T | table T S demoval anotherdemo lastdemo

Then you can create a table with rows that have the common T values alongside the S, demoval, anotherdemo, and lastdemo values there were previously part of separate events.

http://docs.splunk.com/Documentation/Splunk/6.0.2/SearchReference/Transaction

0 Karma

mkrauss1
Explorer

Thanks, the table staement made it.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...