Splunk Search

Merge cells together when having one same Value

lslschr
Engager

Hello Together

I have a little difficulty with the merging of cells. The idea is that if the results for the value JobID in the table have the same value, the entries for Start Time and End Time should be merged.

 

 

 

index=MYINDEX host=MYHOST sourcetype=regway:server status=COMPLETED
| eval "End Time"=strftime(_time,"%c") 
| append [ search index=MYINDEX host=MYHOST sourcetype=MYINDEX:server "Created metadata export job with id:" 
| rex "id: (?<JobID>\w{1,}-\w{1,}-\w{1,}-\w{1,}-\w{1,})" 
| eval "Start Time"=strftime(_time,"%c")]
| sort JobID
| table "Start Time", "End Time" , JobID

 

 

 

My Result looks currently like this: 
search_splunk_today.png

 

Labels (1)
0 Karma
1 Solution

lslschr
Engager

just found out the answer after testing some times:

Simply used 

| stats values(*) as * by JobID

 

View solution in original post

Smashley
Explorer

You may want to look at using a transaction to merge the events into a single transaction, though this can be expensive depending on certain factors. Something like adding "| transaction JobID" after the append should do it. Alternately you could do a join rather than append.

0 Karma

lslschr
Engager

just found out the answer after testing some times:

Simply used 

| stats values(*) as * by JobID

 

Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...