Splunk Search

How to merge two events with same field into one

sudeep5689
Explorer

I have two rows having follwing values:
Name Text Count
A ABC 1
A EFG 1

I want that my result should be displayed in single row showing count as 2 and both the text for a common name = A. Is there a way we can acheive this

0 Karma
1 Solution

gcusello
Legend

Hi @sudeep5689,
try something like this:

your_search
| stats values(Text) AS Text sum(Count) AS Count BY Name

Ciao.
Giuseppe

View solution in original post

0 Karma

gcusello
Legend

Hi @sudeep5689,
try something like this:

your_search
| stats values(Text) AS Text sum(Count) AS Count BY Name

Ciao.
Giuseppe

0 Karma

sudeep5689
Explorer

Hi Thanks for your response, but when i tried this, its not displaying the count .I mean count should be displayed in the count column. but its not displaying it

0 Karma

jrceja313
Engager

If Count is actually a field, the above should work. If not, try this.

your_search
| stats values(Text) as Text, count as Count by Name
| table Name, Text, Count
| eval Text=mvjoin(Text,",")

the eval Text mvjoin can be added if you want it to be a comma separated list

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>