Merge rows in one

[alex_orl]

I have data of the kind

Name       Parameter1            Parameter2           Parameter3
A          1
A                                2                    3
B                                                      3
B                                2                    

I want to get the result as shown below

Name       Parameter1            Parameter2           Parameter3
A          1                     2                    3
B                                2                    3

Thanks

[renjith_nair · Accepted solution]

@alex_orl,

Try

your search | stats values(*) as * by Name

[jpolvino]

Looking at the top code, will there ever be the case where row 2 and row 3 will both have Parameter1?

You can try something like:
(your search)
| stats list(Parameter1) AS Parameter1 list(Parameter2) AS Parameter2 list(Parameter3) AS Parameter3 BY Name

[kamlesh_vaghela]

@alex_orl

Try this

YOUR_SEARCH | stats values(Parameter1) as Parameter1 values(Parameter2) as Parameter2 values(Parameter3) as Parameter3 by Name

Example:

| makeresults | eval _raw="     Name       Parameter1            Parameter2           Parameter3
     A          1
     A                                2                    3
     B                                                      3
     B                                2                    
"| multikv | stats values(Parameter1) as Parameter1 values(Parameter2) as Parameter2 values(Parameter3) as Parameter3 by Name

Thanks

[timyong80]

Thanks! I was looking for this too and it helps. I find that I only need to use the line below without needing | makeresults. Could you explain more about | makeresults?

| multikv | stats values(Parameter1) as Parameter1 values(Parameter2) as Parameter2 values(Parameter3) as Parameter3 by Name

  Thank you.

[bradparks]

This totally worked for me thanks a ton! For anyone new to this, the fields will look like they've each been merged into a single value in each Parameter, but are still separate values in a way - they're Multivalues now - so to merge 2 multivalues into one, use mkjoin or mkindex(field,0)+mkindex(field,1)