To merge rows of a column into one

[Mrig342]

Hi All,

I am trying to merge  the rows of a column into one row for the below table:

App_Name Country Last_Deployed Temp_Version

com.citiao.cimainproject	China	2021-09-24 13:30:04.39	1.0.12.20210907193849359
com.citiao.cimainproject	HongKong	2021-09-24 11:48:15.176	1.0.12.20210907193849359
com.citiao.cimainproject	Indonesia	2021-09-10 13:17:38.254	1.0.12.20210907193849359
com.citiao.cimainproject	Malaysia	2021-09-10 14:54:54.098	1.0.12.20210907193849359
com.citiao.cimainproject	Philippines	2021-09-24 11:58:44.034	1.0.12.20210907193849359
com.citiao.cimainproject	Singapore	2021-09-10 12:53:25.539	1.0.12.20210907193849359
com.citiao.cimainproject	Thailand	2021-09-24 14:01:09.682	1.0.12.20210907193849359
com.citiao.cimainproject	Vietnam	2021-09-10 15:00:06.598	1.0.12.20210907193849359

I used the query as below:

my query | stats values(App_Temp_Name) as App_Name latest(LAST_DEPLOYED) as Last_Deployed latest(APP_TEMP_VER) as Temp_Version by Country | table App_Name,Country,Last_Deployed,Temp_Version

But I need to merge the rows of the column App_Name as one row keeping others as it is like:

App_Name Country Last_Deployed Temp_Version

com.citiao.cimainproject	China	2021-09-24 13:30:04.39	1.0.12.20210907193849359
	HongKong	2021-09-24 11:48:15.176	1.0.12.20210907193849359
	Indonesia	2021-09-10 13:17:38.254	1.0.12.20210907193849359
	Malaysia	2021-09-10 14:54:54.098	1.0.12.20210907193849359
	Philippines	2021-09-24 11:58:44.034	1.0.12.20210907193849359
	Singapore	2021-09-10 12:53:25.539	1.0.12.20210907193849359
	Thailand	2021-09-24 14:01:09.682	1.0.12.20210907193849359
	Vietnam	2021-09-10 15:00:06.598	1.0.12.20210907193849359

Please help me modify the query to get the desired output.

Thank you very much..!!

[PickleRick]

Short answer is don't do it. Long answer is - you're losing information this way. Unless you have a very very strange use case, there's no point in removing values from subsequent events. Remember that you can always sort or reorder fields and you lose the order and association with the initial value completely.

You might group the values into multivalue field but then you'd get a single event with multiple values per field. That's sometimes useful for final presentation but rarely within a processing pipeline since you lose the connection between order of items in separate fields.

So, what do you really want? 🙂

[ITWhisperer]

| stats list(*) as * by App_Name