How to consolidate this data

Splunk Search

Hi, I have two entries for this productid, Is it possible to consolidate to one entry maybe with evals?

|selfjoin productid

| stats values(*) as * by productid

Get Updates on the Splunk Community!

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

The goal of the SplunkTrust™ membership has historically been to acknowledge and recognize those who go above ...

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...

Join the Conversation