Splunk Search

How to combine multiple rows in a field to one row in the same field?

splunkerer
Path Finder

I have a data set as seen below.

exec                   arguments

/bin/sh
sh
-c
uname -p ** /dev/null
/sbin/ldconfig
/bin/sh
/sbin/ldconfig
-p
/bin/uname
uname
-m

 

as seen above sample data, some of the argument fields have 3 lines on them, some of them 2 or 5 etc. all of them are different. 

I would like to get the following result

exec                           arguments
----------------------------------------
/bin/sh                      sh -c uname -p ** /dev/null
/sbin/ldconfig        /bin/sh /sbin/ldconfig -p
/bin/uname             uname -m

How can I get this result?
Thanks,

Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

If arguments is a multi-value field, use

| eval arguments=mvjoin(arguments," ")

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

If arguments is a multi-value field, use

| eval arguments=mvjoin(arguments," ")

splunkerer
Path Finder

wow, I spent 2 hours to resolve this. you are amazing! Thanks a bunch! 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

If the data is strictly formatted, you can use rex to simply collapse lines:  

 

| rex field=arguments mode=sed "s/
/ /g"

 

 e.g.,

 

| makeresults 
| eval exec = "/bin/sh", arguments = "sh
-c
uname -p ** /dev/null"
| rex field=arguments mode=sed "s/
/ /g"

 

gives

_timeargumentsexec
2021-05-20 06:33:07sh -c uname -p ** /dev/null/bin/sh

 

Without  rex, the output is

_timeargumentsexec
2021-05-20 06:42:40

sh

-c

uname -p ** /dev/null

/bin/sh
0 Karma

splunkerer
Path Finder

Thanks for sharing your solution, but this did not work on my end. 

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...