Splunk Search

How to combine multiple rows in a field to one row in the same field?

splunkerer
Path Finder

I have a data set as seen below.

exec                   arguments

/bin/sh
sh
-c
uname -p ** /dev/null
/sbin/ldconfig
/bin/sh
/sbin/ldconfig
-p
/bin/uname
uname
-m

 

as seen above sample data, some of the argument fields have 3 lines on them, some of them 2 or 5 etc. all of them are different. 

I would like to get the following result

exec                           arguments
----------------------------------------
/bin/sh                      sh -c uname -p ** /dev/null
/sbin/ldconfig        /bin/sh /sbin/ldconfig -p
/bin/uname             uname -m

How can I get this result?
Thanks,

Labels (1)
Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

If arguments is a multi-value field, use

| eval arguments=mvjoin(arguments," ")

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

If arguments is a multi-value field, use

| eval arguments=mvjoin(arguments," ")

splunkerer
Path Finder

wow, I spent 2 hours to resolve this. you are amazing! Thanks a bunch! 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

If the data is strictly formatted, you can use rex to simply collapse lines:  

 

| rex field=arguments mode=sed "s/
/ /g"

 

 e.g.,

 

| makeresults 
| eval exec = "/bin/sh", arguments = "sh
-c
uname -p ** /dev/null"
| rex field=arguments mode=sed "s/
/ /g"

 

gives

_timeargumentsexec
2021-05-20 06:33:07sh -c uname -p ** /dev/null/bin/sh

 

Without  rex, the output is

_timeargumentsexec
2021-05-20 06:42:40

sh

-c

uname -p ** /dev/null

/bin/sh
0 Karma

splunkerer
Path Finder

Thanks for sharing your solution, but this did not work on my end. 

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...