Splunk Search

How to group by and concat column values?

spl_1991
Engager

Given the below scenario:

base search| table service_name,status,count

Service_name

Status

Count

serviceA

500_INTERNAL _ERROR

10

serviceA

404_NOT_FOUND

4

serviceB

404_NOT_FOUND

1

serviceC

500_INTERNAL_ERROR

2

ServiceC

404_NOT_FOUND

5

serviceD

206_PARTIAL_ERROR

1

 

How can I display the results with group by service_name and the result as below table:

Service_name

Status

Count

serviceA

500_INTERNAL _ERROR, 404_NOT_FOUND

14

serviceB

404_NOT_FOUND

1

serviceC

500_INTERNAL_ERROR, 404_NOT_FOUND

7

serviceD

206_PARTIAL_ERROR

1

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @spl_1991,

please try this:

base search
| stats values(status) AS status sum(count) AS count BY service_name

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @spl_1991,

please try this:

base search
| stats values(status) AS status sum(count) AS count BY service_name

Ciao.

Giuseppe

spl_1991
Engager

Hi @gcusello ,

Thanks a lot and it worked....grazie!!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...