Splunk Search

How to create single row from multiple results?

yk010123
Path Finder

Hi team, I have the following table with results

ID processing time actor
123 20 actor1
123 30 actor2
123 40 actor3

 

And I'd like to combine them as a single result like : 

ID actor1 actor2 actor3
123 20 30 40

 

The list of actors is not known in advance 

Is this possible? Thank you

Labels (3)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Sorry, I got that the wrong way around

| xyseries ID actor 'processing time'

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| xyseries ID 'processing time' actor
0 Karma

yk010123
Path Finder

Thank you for replying but that does not seem to be creating the expected output. What I am seeing is 

 

id2030353640
123actor1actor2  actor3
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Sorry, I got that the wrong way around

| xyseries ID actor 'processing time'

yk010123
Path Finder

Thank you. That seems to be the solution

Do you know how could I handle duplicates here? For example, sometimes the same actor appears more than once in the results and I'd like to include both somehow(maybe with the _time?)

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| chart list('processing time') by ID actor

yk010123
Path Finder

Thank you. 

Is it possible to include the _time when that happened? 

For example, I'd like to know which one is the original and which one is the duplicated

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...