How do you consolidate values when fields are the same?

[riffe88]

Hey guys,

thanks for taking time out of your day. I'm relatively new to Splunk and just need help with formatting some output from a search. Essentially, this is what I have:

source=sourcetype | fieldA=*, fieldB=* | table _time, fieldA, fieldB | sort fieldA => that outputs this:

_time | fieldA | fieldB
datetime | JohnDoe | 123456
datetime | JohnDoe | 7890

I'd like it to output:

_time | fieldA | fieldB
datetime | JohnDoe | 123456, 7890

I'm just having some trouble with the syntax. Thanks again for your time!

[samhays · Accepted solution]

Would something like the following meet your needs?

source=sourcetype 
| stats values(fieldB) by fieldA

or maybe

source=sourcetype 
| stats values(fieldB), values(_time) as time  by fieldA
| convert ctime(time)

[riffe88]

That worked beautifully! Thanks so much, Sam!

[samhays]

glad it worked for you! I converted the comment to an answer for future folks.

[mstjohn_splunk]

Hi @riffe88,

Glad that this answer was able to help ya. Would you mind approving it for us so that future users will know it's the correct solution? Thanks!

[samhays]

Is datetime exactly the same for those two events?

[riffe88]

No, but fieldA is. Basically, fieldA generates a lot of the same entry with different values for that entry going into fieldB. I'm doing file integrity monitoring, so the return is like this:

test.txt | hash=1348571934854719328741129
test.txt | hash=9873249857345098809453899

I'm trying to consolidate the different values of hashes into one multivalue cell for each unique filename.