Splunk Search

How to merge two events with same field into one

sudeep5689
Explorer

I have two rows having follwing values:
Name Text Count
A ABC 1
A EFG 1

I want that my result should be displayed in single row showing count as 2 and both the text for a common name = A. Is there a way we can acheive this

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @sudeep5689,
try something like this:

your_search
| stats values(Text) AS Text sum(Count) AS Count BY Name

Ciao.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sudeep5689,
try something like this:

your_search
| stats values(Text) AS Text sum(Count) AS Count BY Name

Ciao.
Giuseppe

0 Karma

sudeep5689
Explorer

Hi Thanks for your response, but when i tried this, its not displaying the count .I mean count should be displayed in the count column. but its not displaying it

0 Karma

jrceja313
Engager

If Count is actually a field, the above should work. If not, try this.

your_search
| stats values(Text) as Text, count as Count by Name
| table Name, Text, Count
| eval Text=mvjoin(Text,",")

the eval Text mvjoin can be added if you want it to be a comma separated list

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...