Splunk Search

How to combine events having one field value same and create single row?

Abhineet
Loves-to-Learn Everything

Hi,

Require to combine events having one field value same and create single row .

Query: 

index=webmethods_dev5555_index 0000000001515185
| rex field=_raw "(?<wmDateTime>[\d\-:\s]+) .*"
| rex field=messageId "(?<docNum>\d+)\|\|(?<whoNum>.*)"
| eval wmcreateDateTime= if( like( message, "%request from EWM%" ), wmDateTime,"")
| eval wmconfirmDateTime=if( like( message, "%request sent to Exacta successfully%" ), wmDateTime,"")
| eval wmsentDateTime=if( like( message, "%ready to send to Exacta%" ), wmDateTime,"")
| lookup wminterface_mapping.csv wmInterface as interface OUTPUT Interface
| table whoNum,Interface,wmcreateDateTime,wmconfirmDateTime,wmsentDateTime

 

OUTPUT:

 

Abhineet_1-1687175823683.png

 

 

We Want output in below format

 

Abhineet_2-1687175949035.png

suggest query to get desired output.

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Abhineet,

please try this:

index=webmethods_dev5555_index 0000000001515185
| rex field=_raw "(?<wmDateTime>[\d\-:\s]+) .*"
| rex field=messageId "(?<docNum>\d+)\|\|(?<whoNum>.*)"
| eval wmcreateDateTime= if( like( message, "%request from EWM%" ), wmDateTime,"")
| eval wmconfirmDateTime=if( like( message, "%request sent to Exacta successfully%" ), wmDateTime,"")
| eval wmsentDateTime=if( like( message, "%ready to send to Exacta%" ), wmDateTime,"")
| lookup wminterface_mapping.csv wmInterface as interface OUTPUT Interface
| stats 
   values(wmcreateDateTime) AS wmcreateDateTime
   values(wmconfirmDateTime) AS wmconfirmDateTime
   values(wmsentDateTime) AS wmsentDateTime
    BY whoNum nterface

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...