Splunk Search

What is a command that does the opposite of mvcombine?

Haybuck15
Explorer

So, I know MV Combine asks that you specify the one unique field in a set of results, and returns a multi-value entry that merges all the non-unique values. I want to do the opposite.

I have a table of events that contains a single non-unique field, and I want to merge the unique fields into a single event. For example, the original table might look something like this:

alt text

And I'm trying to turn it into something like this:

alt text

Does anyone have any insight into how I could do that?

0 Karma
1 Solution

493669
Super Champion

Try this:

...|stats values(*) as * by Hostname

It will give all unique values by Hostname

View solution in original post

493669
Super Champion

Try this:

...|stats values(*) as * by Hostname

It will give all unique values by Hostname

Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...