Splunk Search

How to create single row from multiple results?

yk010123
Path Finder

Hi team, I have the following table with results

ID processing time actor
123 20 actor1
123 30 actor2
123 40 actor3

 

And I'd like to combine them as a single result like : 

ID actor1 actor2 actor3
123 20 30 40

 

The list of actors is not known in advance 

Is this possible? Thank you

Labels (3)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Sorry, I got that the wrong way around

| xyseries ID actor 'processing time'

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| xyseries ID 'processing time' actor
0 Karma

yk010123
Path Finder

Thank you for replying but that does not seem to be creating the expected output. What I am seeing is 

 

id2030353640
123actor1actor2  actor3
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Sorry, I got that the wrong way around

| xyseries ID actor 'processing time'

yk010123
Path Finder

Thank you. That seems to be the solution

Do you know how could I handle duplicates here? For example, sometimes the same actor appears more than once in the results and I'd like to include both somehow(maybe with the _time?)

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| chart list('processing time') by ID actor

yk010123
Path Finder

Thank you. 

Is it possible to include the _time when that happened? 

For example, I'd like to know which one is the original and which one is the duplicated

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...