Splunk Search

Merging rows with same values

keishamtcs
Explorer

Hi Guys,

Need help on merging data. i have two columns ( first and second) which has the same value but instead of showing two different lines, i need to show to only one value for these columns while the 3rd and 4th column remains as individual rows. Please let me know how to resolve this.

StorageArray_serialNumber   TotalPorts  LinkStatusType  StorageArray_Port_topology
92213279                      16                   8                 Link Failure
92213279                      16                 8               LinkUp(F_Port Connected)

My desired output.

StorageArray_serialNumber   TotalPorts  StorageArray_Port_topology  LinkStatusType
                                                     Link Failure            8
92213279                      16       -----------------------------------------------------------
                                                    LinkUp(F_Port Connected)       8                
                                        ---------------------------------------------------------------- 
Tags (1)
0 Karma

somesoni2
Revered Legend

Try something like this

your current search with first output | stats list(*) as * by StorageArray_serialNumber, TotalPorts    
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

What’s New in Splunk AI: Volume 02

Welcome to the second edition of “What’s New in Splunk AI” where we look at the latest and greatest updates, ...

Splunk App Dev Quarterly Roundup: AI, Agents, and Innovation!

Another quarter, another wave of innovation. From complex integrations to pushing the limits ...

Value Insights: Now Generally Available in the CMC

Organizations are under pressure to move faster, control cost, expand AI adoption, and prove value with more ...