Splunk Search

How to combine events having one field value same and create single row?

Abhineet
Loves-to-Learn Everything

Hi,

Require to combine events having one field value same and create single row .

Query: 

index=webmethods_dev5555_index 0000000001515185
| rex field=_raw "(?<wmDateTime>[\d\-:\s]+) .*"
| rex field=messageId "(?<docNum>\d+)\|\|(?<whoNum>.*)"
| eval wmcreateDateTime= if( like( message, "%request from EWM%" ), wmDateTime,"")
| eval wmconfirmDateTime=if( like( message, "%request sent to Exacta successfully%" ), wmDateTime,"")
| eval wmsentDateTime=if( like( message, "%ready to send to Exacta%" ), wmDateTime,"")
| lookup wminterface_mapping.csv wmInterface as interface OUTPUT Interface
| table whoNum,Interface,wmcreateDateTime,wmconfirmDateTime,wmsentDateTime

 

OUTPUT:

 

Abhineet_1-1687175823683.png

 

 

We Want output in below format

 

Abhineet_2-1687175949035.png

suggest query to get desired output.

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Abhineet,

please try this:

index=webmethods_dev5555_index 0000000001515185
| rex field=_raw "(?<wmDateTime>[\d\-:\s]+) .*"
| rex field=messageId "(?<docNum>\d+)\|\|(?<whoNum>.*)"
| eval wmcreateDateTime= if( like( message, "%request from EWM%" ), wmDateTime,"")
| eval wmconfirmDateTime=if( like( message, "%request sent to Exacta successfully%" ), wmDateTime,"")
| eval wmsentDateTime=if( like( message, "%ready to send to Exacta%" ), wmDateTime,"")
| lookup wminterface_mapping.csv wmInterface as interface OUTPUT Interface
| stats 
   values(wmcreateDateTime) AS wmcreateDateTime
   values(wmconfirmDateTime) AS wmconfirmDateTime
   values(wmsentDateTime) AS wmsentDateTime
    BY whoNum nterface

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...