How do I merge these search results into one line?

[leochan]

Is there a way to combine the following the following result into one line?

Current Result:

q2.example.com  26,575.24    
q2.example.com                  595.89 MB
1p.example.com  12,911.08    
1p.example.com              218.39 MB

Expected Result:

q2.example.com  26,575.24    595.89 MB
1p.example.com     12,911.08    218.39 MB

Sample data:

11/13/2015 21:04:42 Total number of bytes transferred:       44,745.47 KB/sec
11/14/2015 21:20:57 Total number of bytes transferred:       42,745.47 KB/sec
11/13/2015 21:04:42 Aggregate data transfer rate:       242.22 MB
11/14/2015 21:20:57 Aggregate data transfer rate:       145.39 MB

Links I visited and tried:
https://answers.splunk.com/answers/58845/multiple-searches-in-one-chart.html
https://answers.splunk.com/answers/40165/merge-two-search-results.html

Search:

index=os_linux earliest=-1d ("Aggregate data transfer rate" OR "Total number of bytes transferred") | rex field=_raw "Aggregate data transfer rate: (?<AggregateTransfer>.*)KB\/sec" | rex field=_raw "Total number of bytes transferred: (?<TotalTransfer>.*)" | table host, AggregateTransfer,TotalTransfer

[sundareshr]

Try this

index=os_linux earliest=-1d "Aggregate"  OR "Total"| rex "e:\s+(?<AggregateTransfer>[\d,\.]+)"  | rex "d:\s+(?<TotalTransfer>[\d,\.]+)"| timechart span=1d sum(AggregateTransfer) as Agg sum(TotalTransfer) as Total | fields - _time

[leochan]

sundareshr,

I don't mean to do a sum, just put all the same fields in one line (See current and expected result).

I think jluo got it.

[jluo_splunk · Accepted solution]

You could do a transaction, though the performance isn't great.

... | transaction host

[leochan]

Thanks Jluo!