How to group togeher the rows based on some field value in splunk

[disha]

I am having a search in my view code and displaying results in the form of table.
small example result:
custid Eventid
10001 200
10001 300
10002 200
10002 100
10002 300

This time each line is coming in each row. Can we group together the same custid with different values on eventid as one row like

        custID   eventid

first row ->10001 200
300
second row->10002 200
100
300

Is there is any way to do that.
Thanks

[_d_ · Accepted solution]

Try these:

...my search here... | stats list(custID) by eventID

or, if you want unique custID:

...my search here... | stats values(custID) by eventID

Hope this helps,

d.

[unitedmarsupial]

Just wanted to add, that those, who want all of their fields to be grouped, can use the asterisk -- instead of painstakingly enumerating them all (and then re-enumerating, when the field-set changes).

This works for all regular fields -- but not for the special ones (like _time), those still must be listed explicitly:

| stats values(*), values(_time), values(_raw) by eventID

[gokulakrishnans]

This query "stats values(custID) by eventID" worked for me. Over here, how to count the list of custID's and display it in a table?

[disha]

Thanks. this thing worked. I need to show some more columns so i just added like
|stats list(eventid), list(time), list(description) by custid

[vsingla1]

After grouping the fields into one list, how do I make this list comma separated?

[unitedmarsupial]

---

@vsingla1 wrote:

After grouping the fields into one list, how do I make this list comma separated?

---

This is, what I have somewhere already -- the field Mnemonic (singular), specific to every event, is grouped into Mnemonics (plural), which is then passed to multi-value join:

| eventstats values(Mnemonic) as Mnemonics
| eval Mnemonics=mvjoin(Mnemonics, ",")