Splunk Search

i want the output in the below format. please answer my query how to achieve it.

AyushiSrivas
Loves-to-Learn

i want the output in the below format :-

Input as below:-

host           sql instance           db name

abc              sql1                          db1

abc               sql1                          db2

abc               sql2                           db123

abc               sql2                           db1234

xyz               xyzsql1                    db11

xyz                xyzsql2                   db321

xyz                xyzsql2                    db123

xyz                xyzsql2                    db1234

www             wwwsql1              db123

www            wwwsql1                db1234

outpu as below:-

host           sql instance           db name

abc              sql1                          db1

                                                         db2

 abc              sql2                        db123

                                                         db1234

xyz               xyzsql1                    db11

xyz                xyzsql2                   db321

                                                          db123

                                                          db1234

www             wwwsql1              db123

                                                          db1234

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| stats values('db name') as "db name" by host 'sql instance'
0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...