Splunk Search

How to create single row from multiple results?

yk010123
Path Finder

Hi team, I have the following table with results

ID processing time actor
123 20 actor1
123 30 actor2
123 40 actor3

 

And I'd like to combine them as a single result like : 

ID actor1 actor2 actor3
123 20 30 40

 

The list of actors is not known in advance 

Is this possible? Thank you

Labels (3)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Sorry, I got that the wrong way around

| xyseries ID actor 'processing time'

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| xyseries ID 'processing time' actor
0 Karma

yk010123
Path Finder

Thank you for replying but that does not seem to be creating the expected output. What I am seeing is 

 

id2030353640
123actor1actor2  actor3
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Sorry, I got that the wrong way around

| xyseries ID actor 'processing time'

yk010123
Path Finder

Thank you. That seems to be the solution

Do you know how could I handle duplicates here? For example, sometimes the same actor appears more than once in the results and I'd like to include both somehow(maybe with the _time?)

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| chart list('processing time') by ID actor

yk010123
Path Finder

Thank you. 

Is it possible to include the _time when that happened? 

For example, I'd like to know which one is the original and which one is the duplicated

0 Karma
Get Updates on the Splunk Community!

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...