Splunk Search

How i can merge two value in one field output

hrs2019
Path Finder

Hi All,

How i can merge two row value in one field. i am trying with case but i am not getting the output.
alt text

0 Karma

to4kawa
SplunkTrust
SplunkTrust
| makeresults 
| eval _raw="product_name,dev,dev1,test,prod
INFO,yes,yes,no,yes
Apple,yes,,yes,yes
Apple1,,yes,," 
| multikv forceheader=1 
| table product_name,dev,dev1,test,prod
| eval matchseg=replace(product_name,"\d+","")
| stats values(*) as * by matchseg
| rename matchseg as product_name
| table product_name,dev,dev1,test,prod
0 Karma

to4kawa
SplunkTrust
SplunkTrust

apple = apple1?
What are the conditions for joining?

0 Karma

hrs2019
Path Finder

Hi @to4kawa
all the dev1 info for Apple1 will display in Apple . i cant show two apple so i am display in one field ie- Apple.

0 Karma

hrs2019
Path Finder

Hi @to4kawa

This value is not fixed time to time this value is chaining in that condition this ll not work.

yes to No and No to yes it changing so i need dynamic solution

0 Karma

to4kawa
SplunkTrust
SplunkTrust

What are the conditions for joining?
This value is not fixed time to time
I see. Which should be remain?
faster? later? Name has digit? non-digit?
I don't know.

0 Karma

vnravikumar
Champion

in addition to @to4kawa solution, check this

| makeresults 
| eval _raw="product_name,dev,dev1,test,prod
 INFO,yes,yes,no,yes
 Apple,yes,,yes,yes
 Apple1,,yes,," 
| multikv forceheader=1 
| table product_name,dev,dev1,test,prod 
| eval matchseg=replace(product_name,"\d+","") 
| streamstats count 
| stats values(*) as * by matchseg 
| mvexpand count 
| stats max(count) as count by matchseg,dev,dev1,test,prod 
| rename matchseg as product_name 
| sort count
| table product_name,dev,dev1,test,prod
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.