Splunk Search

How to group togeher the rows based on some field value in splunk

disha
Contributor

I am having a search in my view code and displaying results in the form of table.
small example result:
custid Eventid
10001 200
10001 300
10002 200
10002 100
10002 300

This time each line is coming in each row. Can we group together the same custid with different values on eventid as one row like

        custID   eventid

first row ->10001 200
300
second row->10002 200
100
300

Is there is any way to do that.
Thanks

Tags (1)
1 Solution

_d_
Splunk Employee
Splunk Employee

Try these:

...my search here... | stats list(custID) by eventID

or, if you want unique custID:

...my search here... | stats values(custID) by eventID

Hope this helps,

d.

View solution in original post

_d_
Splunk Employee
Splunk Employee

Try these:

...my search here... | stats list(custID) by eventID

or, if you want unique custID:

...my search here... | stats values(custID) by eventID

Hope this helps,

d.

unitedmarsupial
Path Finder

Just wanted to add, that those, who want all of their fields to be grouped, can use the asterisk -- instead of painstakingly enumerating them all (and then re-enumerating, when the field-set changes).

This works for all regular fields -- but not for the special ones (like _time), those still must be listed explicitly:

| stats values(*), values(_time), values(_raw) by eventID

 

gokulakrishnans
Explorer

This query "stats values(custID) by eventID" worked for me. Over here, how to count the list of custID's and display it in a table?

0 Karma

disha
Contributor

Thanks. this thing worked. I need to show some more columns so i just added like
|stats list(eventid), list(time), list(description) by custid

vsingla1
Communicator

After grouping the fields into one list, how do I make this list comma separated?

unitedmarsupial
Path Finder

@vsingla1 wrote:

After grouping the fields into one list, how do I make this list comma separated?


This is, what I have somewhere already -- the field Mnemonic (singular), specific to every event, is grouped into Mnemonics (plural), which is then passed to multi-value join:

| eventstats values(Mnemonic) as Mnemonics
| eval Mnemonics=mvjoin(Mnemonics, ",")

 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...