I have a Splunk query that parses the msg field, fetches the fields from the result and displays them in a table. PFA  Now, the issue is, each field in the row has a unique time, but more than 1 row could have the same fields, except the time as shown in attached file.  Can we enhance the query in a way, that if for more than 1 row, the fields are same except time, then we can have just row with those fields, and times can as be added as a list (separated by commas) to that final row.  Example, if 2 rows are   Value1, time1, Value2, Value3 Value1, time2, Value2, Value3   Then it could be represented as   Value1, {time1, time2}, Value 2, Value3   This would reduce the space the 2 (or more than 2) rows take on the Dashboard page.  Here is the existing query:    index=myIndex "ERROR * ---" "taskExecutor-*" | rex field=msg "^(?<Time>\S+\s+\S+)\s+\S+\s+(?<Error_Code>\d+)[^\]]+\]\s+(?<Service_Name>\S+)\s+:\s+(?<Error_Message>.+)" | table Error_Message Error_Code Service_Name Time | eventstats count as Count by Error_Message Error_Code Service_Name | sort -Count   Any help would be appreciated.  ... View more

I have Splunk results in following format:   2021-11-13 01:02:50.127 ERROR 23 --- [ taskExecutor-2] c.c.p.r.service.RedisService : The Redis Cache had no record for key: null Returning empty list. 2021-10-22 21:11:51.996 ERROR 22 --- [ taskExecutor-1] c.c.p.r.service.SftpService : Could not delete file: /-/XYZ.FILE - 4: Failure 2021-10-22 02:05:14.426 ERROR 22 --- [ taskExecutor-1] c.c.p.r.service.SftpService : Could not delete file: /-/XYZ.FILE - 4: Failure   I want to create a Visualization in the following format - In the attached screenshot.  The **count variable** is based on the "Error Message" only. Since "Could not delete file: /-/XYZ.FILE - 4: Failure" appeared twice, hence the count is set to 2. As the logs grow, and this message occurrence increase, this count should increase too. I tried using erex and substring from Splunk but kinda failed miserably! Any help on how to form the Splunk query for this visualization would be appreciated. Thanks ... View more

I want to populate the list of hosts in the multiselect input option in Splunk. index=someIndexName * host!="notThis*" | stats values(host) as host I can see the list of hosts getting populated in Splunk. However, they are not getting populated in multiselect list. It says "populating" and nothing shows up. ... View more