Splunk Search

How to group by and concat column values?

spl_1991
Engager

Given the below scenario:

base search| table service_name,status,count

Service_name

Status

Count

serviceA

500_INTERNAL _ERROR

10

serviceA

404_NOT_FOUND

4

serviceB

404_NOT_FOUND

1

serviceC

500_INTERNAL_ERROR

2

ServiceC

404_NOT_FOUND

5

serviceD

206_PARTIAL_ERROR

1

 

How can I display the results with group by service_name and the result as below table:

Service_name

Status

Count

serviceA

500_INTERNAL _ERROR, 404_NOT_FOUND

14

serviceB

404_NOT_FOUND

1

serviceC

500_INTERNAL_ERROR, 404_NOT_FOUND

7

serviceD

206_PARTIAL_ERROR

1

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @spl_1991,

please try this:

base search
| stats values(status) AS status sum(count) AS count BY service_name

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @spl_1991,

please try this:

base search
| stats values(status) AS status sum(count) AS count BY service_name

Ciao.

Giuseppe

spl_1991
Engager

Hi @gcusello ,

Thanks a lot and it worked....grazie!!

0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...