Splunk Search

What is a command that does the opposite of mvcombine?

Haybuck15
Explorer

So, I know MV Combine asks that you specify the one unique field in a set of results, and returns a multi-value entry that merges all the non-unique values. I want to do the opposite.

I have a table of events that contains a single non-unique field, and I want to merge the unique fields into a single event. For example, the original table might look something like this:

alt text

And I'm trying to turn it into something like this:

alt text

Does anyone have any insight into how I could do that?

0 Karma
1 Solution

493669
Super Champion

Try this:

...|stats values(*) as * by Hostname

It will give all unique values by Hostname

View solution in original post

493669
Super Champion

Try this:

...|stats values(*) as * by Hostname

It will give all unique values by Hostname

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...