How to search and sort based on dynamic value?

[batham]

Hi,

I am new to splunk and have a requirement where i have to search the logs which are on 100 servers and i have to figure if each log may consist 2 statements as below ex:

"started step1"

"started step2"

source of log contains actual name of source where i can check the step (location of log /test/test1/ABC.log ,/test/test1/CDE.log,/test/test1/DEF.log) which i figured out based on rex command (using regex) 

I want a table which contain for each log how many step are completed. like:

ABC      started step1  started step2

CDE    started step1

DEF    started step1 started step2

[batham · Accepted solution]

Thanks, though while searching in community i find the answer https://community.splunk.com/t5/Splunk-Search/Combine-multiple-rows-in-one-with-a-common-key/td-p/42...

[richgalloway]

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

[richgalloway]

Perhaps this will help

index=foo ("started step1" OR "started step2")
```Extract the step into a field```
| rex "(?<step>started step\d)"
```Group the steps by reporting host```
| stats values(step) as steps by host