Splunk Search

How to group by and concat column values?

spl_1991
Engager

Given the below scenario:

base search| table service_name,status,count

Service_name

Status

Count

serviceA

500_INTERNAL _ERROR

10

serviceA

404_NOT_FOUND

4

serviceB

404_NOT_FOUND

1

serviceC

500_INTERNAL_ERROR

2

ServiceC

404_NOT_FOUND

5

serviceD

206_PARTIAL_ERROR

1

 

How can I display the results with group by service_name and the result as below table:

Service_name

Status

Count

serviceA

500_INTERNAL _ERROR, 404_NOT_FOUND

14

serviceB

404_NOT_FOUND

1

serviceC

500_INTERNAL_ERROR, 404_NOT_FOUND

7

serviceD

206_PARTIAL_ERROR

1

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @spl_1991,

please try this:

base search
| stats values(status) AS status sum(count) AS count BY service_name

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @spl_1991,

please try this:

base search
| stats values(status) AS status sum(count) AS count BY service_name

Ciao.

Giuseppe

spl_1991
Engager

Hi @gcusello ,

Thanks a lot and it worked....grazie!!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...