Splunk Search

How to combine duplicate multiple rows into one row in a table?

wanda619
Path Finder

Hi Community,

I have a data as follows - 

Customer

Error Code

Result

Abc

1111

2

Abc

1111

3

Abc

1222

4

Abc

Total

4

Abc

Total

5

 

 

I want to combine the Total into single row Total showing the result column as - Total : 9.

My code now - 

| stats count as Result by Customer, ErrorCode
| eval PercentOfTotal=100
| append
[search index=sourcetype= abc: source= */ABC/* ErrorCode!=0
| stats count as Result by Customer
| eval ErrorCode="Total", PercentOfTotal=100]
| lookup xyz ErrorCode OUTPUT Description
| lookup pqr Customer OUTPUT Customer_Name
| eval Customer_Name=coalesce(Customer_Name,Customer)
| eval Error=if(ErrorCode!="Total", ErrorCode+" ("+coalesce(Description,"Description Missing - Update xyz")+")", ErrorCode)
| fields CustomerName, Error, Result

Labels (3)
0 Karma
1 Solution

somesoni2
Revered Legend

I'm sure there will be a better option than this but without knowing your data, it would be difficult to suggest that. Try to add following to your current search(at the end):

Your current search
| fields CustomerName, Error, Result
| stats sum(Result) as Result by CustomerName, Error

View solution in original post

somesoni2
Revered Legend

I'm sure there will be a better option than this but without knowing your data, it would be difficult to suggest that. Try to add following to your current search(at the end):

Your current search
| fields CustomerName, Error, Result
| stats sum(Result) as Result by CustomerName, Error

martinpu
Communicator
| stats count as Result by Customer, ErrorCode
| eval PercentOfTotal=100
| addcoltotals Result
|fillnull 'Error Code' value="Total"

 

You can sum up your counts with the addcoltotals command as shown above.

 

 

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...