Splunk Search
Highlighted

Merge rows in one

Engager

I have data of the kind

Name       Parameter1            Parameter2           Parameter3
A          1
A                                2                    3
B                                                      3
B                                2                    

I want to get the result as shown below

Name       Parameter1            Parameter2           Parameter3
A          1                     2                    3
B                                2                    3

Thanks

Highlighted

Re: Merge rows in one

SplunkTrust
SplunkTrust

@alex_orl

Try this

YOUR_SEARCH | stats values(Parameter1) as Parameter1 values(Parameter2) as Parameter2 values(Parameter3) as Parameter3 by Name

Example:

| makeresults | eval _raw="     Name       Parameter1            Parameter2           Parameter3
     A          1
     A                                2                    3
     B                                                      3
     B                                2                    
"| multikv | stats values(Parameter1) as Parameter1 values(Parameter2) as Parameter2 values(Parameter3) as Parameter3 by Name

Thanks

Highlighted

Re: Merge rows in one

Explorer

This totally worked for me thanks a ton! For anyone new to this, the fields will look like they've each been merged into a single value in each Parameter, but are still separate values in a way - they're Multivalues now - so to merge 2 multivalues into one, use mkjoin or mkindex(field,0)+mkindex(field,1)

0 Karma
Highlighted

Re: Merge rows in one

Builder

Looking at the top code, will there ever be the case where row 2 and row 3 will both have Parameter1?

You can try something like:
(your search)
| stats list(Parameter1) AS Parameter1 list(Parameter2) AS Parameter2 list(Parameter3) AS Parameter3 BY Name

0 Karma
Highlighted

Re: Merge rows in one

SplunkTrust
SplunkTrust

@alex_orl,

Try

your search | stats values(*) as * by Name

View solution in original post