How to Combine 2 rows

[minihyo]

Hi,

 I'm new to Splunk. I expect to combine 2 rows like this but dont know how

COL1	COL2	VALUE
c1	c2	Amy
c2	c1	Bob
c3	c4	Carol
c4	c3	David

Expected answer

NEWC3	VALUE
c1 / c2	Amy Bob
c3 / c4	Carol David

Thanks

[richgalloway]

Try this run-anywhere example.

| makeresults 
| eval _raw="COL1	COL2	VALUE
c1	c2	Amy
c2	c1	Bob
c3	c4	Carol
c4	c3	David" 
| multikv forceheader=1
```Above just defines test data```
| eval COL3=mvappend(COL1, COL2)
| eval COL3=mvjoin(mvsort(COL3),",")
| stats values(VALUE) as VALUE by COL3

[gcusello]

Hi @minihyo,

please, try something like this:

| makeresults
| eval _raw="COL1	COL2	VALUE
c1	c2	Amy
c2	c1	Bob
c3	c4	Carol
c4	c3	David"
| multikv forceheader=1
| eval ppp1=COL1.",".COL2, ppp2=COL2.",".COL1
| makemv delim="," ppp1
| makemv delim="," ppp2
| eval ppp1=mvsort(ppp1), ppp2=mvsort(ppp2)
| eval ppp=mvindex(ppp1,0)."/".mvindex(ppp1,1)
| stats values(VALUE) AS VALUE BY ppp

Ciao.

Giuseppe