How to join two fields?

[venkatesh296]

Hi All,
After doing some search, I got output as

x                                                                avg                 median
2017-01-11 12:16:00,[Process],D:\Program Files\local.Log         3                   5

The output I need should be like

 x                                                               avg                 median
2017-01-11 12:16:00,
[Process],
D:\Program Files\local.Log                                       3                   5

Thanks.

Here is the search:

index=abs (source=*log*)
| rex "(?i)log\s(?\[\w+.\w+])" | rex "in\s+(?P\d+)\s+\ms" | rex "in\s(?\d+.\d+)\" 
|eval seconds=(seconds/1000)
|eval seconds=coalesce(seconds,us)
| eval source=replace(source,"\d+\.log$",".log")
| table  _time sourceMETHOD seconds  
| bin  _time span=1m 
|eval _time=strftime(_time,"%Y-%m-%d %H:%M:%S")
|eval x=_time.",".METHOD.",".source
| stats  median(seconds) as median by x source METHOD 
| search METHOD="[Process]"
|eventstats  count as Linecount sum(median) as Total
|eval average=Total/Linecount
|fields x average median

[lguinn2]

When you pasted your search into the comment, it lost some information. The rex commands don't make any sense now - but I have copied them here. This should work

 index=abs source=*log*
 | rex "(?i)log\s(?\[\w+.\w+])" | rex "in\s+(?P\d+)\s+\ms" | rex "in\s(?\d+.\d+)\"
 | search METHOD="[Process]"
 | eval seconds=(seconds/1000)
 | eval seconds=coalesce(seconds,us)
 | eval source=replace(source,"\d+\.log$",".log")
 | bin span=1m _time
 | eval x = strftime(_time,"%x %X") . "\n" . METHOD . "\n" . source
 | stats median(seconds) as median by x 
 | eventstats count as Linecount sum(median) as Total
 | eval average=Total/Linecount
 | fields x average median

Although it seems to me that METHOD is not really needed at all, since you have filtered to show only the Process method. And I am a bit uncomfortable with the calculation of average: in the eventstats command, as count will be only a count of the number of stats results, not the count of events returned by the search. I did a couple of things to make the search more efficient.

[somesoni2]

What is the difference in these two outputs? single line vs multiline?? If that is the case, try this

your current search giving fields x, average, median | makemv x delim=","

[aaraneta_splunk]

@venkatesh296 - Can you provide the search that you used? That would be helpful for users attempting to assist you in how you got your initial output and how you want your output to look like.

In general, your question has a greater chance of being answered by experts in the Answers community when when you provide as much information and context as possible. Thanks.

[venkatesh296]

index=abs (source=*log*)   | rex "(?i)log\s(?\[\w+.\w+])" | rex "in\s+(?P\d+)\s+\ms" | rex "in\s(?\d+.\d+)\" |eval seconds=(seconds/1000)|eval seconds=coalesce(seconds,us)| eval source=replace(source,"\d+\.log$",".log")| table  _time sourceMETHOD seconds  | bin  _time span=1m |eval _time=strftime(_time,"%Y-%m-%d %H:%M:%S")|eval x=_time.",".METHOD.",".source| stats  median(seconds) as median by x source METHOD | search METHOD="[Process]"|eventstats  count as Linecount sum(median) as Total|eval average=Total/Linecount|fields x average median

[aaraneta_splunk]

@venkatesh296 - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.