How to extract unique values from events with multiple values?

[ipops]

I am importing SQL data into Splunk.
Each record contains SessionID, message, and VarValue.

SessionID is always unique, but message and VarValue contain different values

Example

Sessionid = 1234,message="Tower", varValue="site1"
SessionID = 1234,message="Platform",varValue="Wireless"
SessionID = 1234,message="City",varValue="mytown"

Sessionid = 2222,message="Tower", varValue="site2"
SessionID = 2222,message="Platform",varValue="Satellite"
SessionID = 2222,message="City",varValue="mytown"

How can I extract the unique message and varValue into separate variables per unique SessionID?

What I would like to do is display the Platform and City within a single search

[sundareshr · Accepted solution]

If the data is already in Splunk, and the three fields have been extracted, see if this works (may need some tweaking)

base search here | eval {message}=varValue | stats values(Tower)  as Tower values(Platform) as Platform values(City) as City by SessionID

If the fields are not extracted, try this

base search here | extract pairdelim="," kvdelim="=" | eval {message}=varValue | stats values(Tower)  as Tower values(Platform) as Platform values(City) as City by SessionID

[ipops]

That worked. Thanks alot!

Only thing is no timestamps are shown when I do the following. Any ideas how to get timestamps?

base search here | extract pairdelim="," kvdelim="=" | eval {message}=varValue | stats values(Tower)  as Tower values(Platform) as Platform values(City) as City by SessionID | table _time Tower Platform City SessionID

[sundareshr]

Like this

base search here | extract pairdelim="," kvdelim="=" | eval {message}=varValue | table _time Tower Platform City SessionID