Splunk Search

How to group by and concat column values?

spl_1991
Engager

Given the below scenario:

base search| table service_name,status,count

Service_name

Status

Count

serviceA

500_INTERNAL _ERROR

10

serviceA

404_NOT_FOUND

4

serviceB

404_NOT_FOUND

1

serviceC

500_INTERNAL_ERROR

2

ServiceC

404_NOT_FOUND

5

serviceD

206_PARTIAL_ERROR

1

 

How can I display the results with group by service_name and the result as below table:

Service_name

Status

Count

serviceA

500_INTERNAL _ERROR, 404_NOT_FOUND

14

serviceB

404_NOT_FOUND

1

serviceC

500_INTERNAL_ERROR, 404_NOT_FOUND

7

serviceD

206_PARTIAL_ERROR

1

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @spl_1991,

please try this:

base search
| stats values(status) AS status sum(count) AS count BY service_name

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @spl_1991,

please try this:

base search
| stats values(status) AS status sum(count) AS count BY service_name

Ciao.

Giuseppe

spl_1991
Engager

Hi @gcusello ,

Thanks a lot and it worked....grazie!!

0 Karma
Get Updates on the Splunk Community!

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...