Splunk Search

How to group same values into one value?

sekhar463
Path Finder

Good day,

 

how to group results of a same filed value into one fileld value

from below table i have a field box-name and in the multiple value of same 

how can i group same value into one value  as below table for same value in BOX_NAME field how can i keep as one value 

 i am using search to table the results 

 

index=indexname sourcetype=sourename
| eval Actualstarttime=strftime(strptime(NEXT_START,"%Y/%m/%d %H:%M:%S"),"%H:%M")
| eval Job_start_by=strftime(strptime(LAST_START,"%Y/%m/%d %H:%M:%S"),"%H:%M")
| table BOX_NAME,JOB_NAME,JOB_GROUP,REGION,TIMEZONE,STATUS,Currenttime,STATUS_TIME,LAST_START,LAST_END,NEXT_START,DAYS_OF_WEEK,EXCLUDE_CALENDAR,RUNTIME,Actualstarttime,Job_start_by,START_SLA,AVG_RUN_TIME



 

BOX_NAME JOB_NAME JOB_GROUP REGION TIMEZONE STATUS

PNB-JAWS-USCA-ORDER-TCA-INBOUND-DAILY PNC-JAWS-USCA-ORDER-TCA-INBOUND-60ZIP JAWS   Central SUCCESS
PNB-JAWS-USCA-ORDER-TCA-INBOUND-DAILY PNC-JAWS-USCA-ORDER-TCA-INBOUND-040INF JAWS   Central SUCCESS
PNB-JAWS-USCA-ORDER-TCA-INBOUND-DAILY PNC-JAWS-USCA-ORDER-TCA-INBOUND-080DEL JAWS   Central SUCCESS
PNB-JAWS-USCA-ORDER-TCA-INBOUND-DAILY PNC-JAWS-USCA-ORDER-TCA-INBOUND-010ARC JAWS   Central SUCCESS
PNB-JAWS-USCA-ORDER-TCA-INBOUND-DAILY PNC-JAWS-USCA-ORDER-TCA-INBOUND-025FW JAWS   Central SUCCESS

 

 

Labels (1)
Tags (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

It's not entirely clear what you mean.

If you want to have a "multirow" cell in your output visualization - kind of "groupping" of the rest of the row data - you can't do that. At least not with any of the built-in visualizations.

0 Karma

sekhar463
Path Finder

hi Thanks for the search

i am getting expected results 

but for somevalues are missing it was showing only Unique values for any field

for example for RUNTIME field it will show 10 values for 10 JOB_NAME field 

but not showing for all of them like below is the out put values but showing only few 

 

0
2
0
2
33
33
33
33
33
33
34
34
34
33
34
35
34
32
34
34
35
34
33
34
33
33
34
33
34
33
34
33
33
34
184
34
33
184
34
34
64
814
94
5
33
33
33
34
34
34
1053
33

 

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sekhar463,

if you don't want unique values but the list of values, you have to replace the values option with the list option, as described at https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/CommonStatsFunctions

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sekhar463,

I'm not sure to have understood your need, you could dedup using one field or use stats:

index=indexname sourcetype=sourename
| eval Actualstarttime=strftime(strptime(NEXT_START,"%Y/%m/%d %H:%M:%S"),"%H:%M")
| eval Job_start_by=strftime(strptime(LAST_START,"%Y/%m/%d %H:%M:%S"),"%H:%M")
| stats  
   values(JOB_NAME) AS JOB_NAME
   values(JOB_GROUP) AS JOB_GROUP
   values(REGION) AS REGION
   values(TIMEZONE) AS TIMEZONE
   values(STATUS) AS STATUS
   values(Currenttime) AS Currenttime
   values(STATUS_TIME) AS STATUS_TIME
   values(LAST_START) AS LAST_START
   values(LAST_END) AS LAST_END
   values(NEXT_START) AS NEXT_START
   values(DAYS_OF_WEEK) AS DAYS_OF_WEEK
   values(EXCLUDE_CALENDAR) AS EXCLUDE_CALENDAR
   values(RUNTIME) AS RUNTIME
   values(Actualstarttime) AS Actualstarttime
   values(Job_start_by) AS Job_start_by
   values(START_SLA) AS START_SLA
   values(AVG_RUN_TIME) AS AVG_RUN_TIME
   BY BOX_NAME

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...