Splunk Search

How to combine multiple rows in a field to one row in the same field?

splunkerer
Path Finder

I have a data set as seen below.

exec                   arguments

/bin/sh
sh
-c
uname -p ** /dev/null
/sbin/ldconfig
/bin/sh
/sbin/ldconfig
-p
/bin/uname
uname
-m

 

as seen above sample data, some of the argument fields have 3 lines on them, some of them 2 or 5 etc. all of them are different. 

I would like to get the following result

exec                           arguments
----------------------------------------
/bin/sh                      sh -c uname -p ** /dev/null
/sbin/ldconfig        /bin/sh /sbin/ldconfig -p
/bin/uname             uname -m

How can I get this result?
Thanks,

Labels (1)
Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

If arguments is a multi-value field, use

| eval arguments=mvjoin(arguments," ")

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

If arguments is a multi-value field, use

| eval arguments=mvjoin(arguments," ")

splunkerer
Path Finder

wow, I spent 2 hours to resolve this. you are amazing! Thanks a bunch! 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

If the data is strictly formatted, you can use rex to simply collapse lines:  

 

| rex field=arguments mode=sed "s/
/ /g"

 

 e.g.,

 

| makeresults 
| eval exec = "/bin/sh", arguments = "sh
-c
uname -p ** /dev/null"
| rex field=arguments mode=sed "s/
/ /g"

 

gives

_timeargumentsexec
2021-05-20 06:33:07sh -c uname -p ** /dev/null/bin/sh

 

Without  rex, the output is

_timeargumentsexec
2021-05-20 06:42:40

sh

-c

uname -p ** /dev/null

/bin/sh
0 Karma

splunkerer
Path Finder

Thanks for sharing your solution, but this did not work on my end. 

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...