Splunk Search

Merge rows in one

alex_orl
Engager

I have data of the kind

Name       Parameter1            Parameter2           Parameter3
A          1
A                                2                    3
B                                                      3
B                                2                    

I want to get the result as shown below

Name       Parameter1            Parameter2           Parameter3
A          1                     2                    3
B                                2                    3

Thanks

1 Solution

renjith_nair
Legend

@alex_orl,

Try

your search | stats values(*) as * by Name
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

@alex_orl,

Try

your search | stats values(*) as * by Name
---
What goes around comes around. If it helps, hit it with Karma 🙂

jpolvino
Builder

Looking at the top code, will there ever be the case where row 2 and row 3 will both have Parameter1?

You can try something like:
(your search)
| stats list(Parameter1) AS Parameter1 list(Parameter2) AS Parameter2 list(Parameter3) AS Parameter3 BY Name

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@alex_orl

Try this

YOUR_SEARCH | stats values(Parameter1) as Parameter1 values(Parameter2) as Parameter2 values(Parameter3) as Parameter3 by Name

Example:

| makeresults | eval _raw="     Name       Parameter1            Parameter2           Parameter3
     A          1
     A                                2                    3
     B                                                      3
     B                                2                    
"| multikv | stats values(Parameter1) as Parameter1 values(Parameter2) as Parameter2 values(Parameter3) as Parameter3 by Name

Thanks

timyong80
Explorer

Thanks! I was looking for this too and it helps. I find that I only need to use the line below without needing | makeresults. Could you explain more about | makeresults?

| multikv | stats values(Parameter1) as Parameter1 values(Parameter2) as Parameter2 values(Parameter3) as Parameter3 by Name

  Thank you.

0 Karma

bradparks
Explorer

This totally worked for me thanks a ton! For anyone new to this, the fields will look like they've each been merged into a single value in each Parameter, but are still separate values in a way - they're Multivalues now - so to merge 2 multivalues into one, use mkjoin or mkindex(field,0)+mkindex(field,1)

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...