Splunk Search

How to create single row from multiple results?

yk010123
Path Finder

Hi team, I have the following table with results

ID processing time actor
123 20 actor1
123 30 actor2
123 40 actor3

 

And I'd like to combine them as a single result like : 

ID actor1 actor2 actor3
123 20 30 40

 

The list of actors is not known in advance 

Is this possible? Thank you

Labels (3)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Sorry, I got that the wrong way around

| xyseries ID actor 'processing time'

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| xyseries ID 'processing time' actor
0 Karma

yk010123
Path Finder

Thank you for replying but that does not seem to be creating the expected output. What I am seeing is 

 

id2030353640
123actor1actor2  actor3
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Sorry, I got that the wrong way around

| xyseries ID actor 'processing time'

yk010123
Path Finder

Thank you. That seems to be the solution

Do you know how could I handle duplicates here? For example, sometimes the same actor appears more than once in the results and I'd like to include both somehow(maybe with the _time?)

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| chart list('processing time') by ID actor

yk010123
Path Finder

Thank you. 

Is it possible to include the _time when that happened? 

For example, I'd like to know which one is the original and which one is the duplicated

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Calling all Splunk architects, platform admins, and app developers: the site is open, and the blueprints are ...

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...