Splunk Search

How to create single row from multiple results?

yk010123
Path Finder

Hi team, I have the following table with results

ID processing time actor
123 20 actor1
123 30 actor2
123 40 actor3

 

And I'd like to combine them as a single result like : 

ID actor1 actor2 actor3
123 20 30 40

 

The list of actors is not known in advance 

Is this possible? Thank you

Labels (3)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Sorry, I got that the wrong way around

| xyseries ID actor 'processing time'

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| xyseries ID 'processing time' actor
0 Karma

yk010123
Path Finder

Thank you for replying but that does not seem to be creating the expected output. What I am seeing is 

 

id2030353640
123actor1actor2  actor3
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Sorry, I got that the wrong way around

| xyseries ID actor 'processing time'

yk010123
Path Finder

Thank you. That seems to be the solution

Do you know how could I handle duplicates here? For example, sometimes the same actor appears more than once in the results and I'd like to include both somehow(maybe with the _time?)

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| chart list('processing time') by ID actor

yk010123
Path Finder

Thank you. 

Is it possible to include the _time when that happened? 

For example, I'd like to know which one is the original and which one is the duplicated

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...