Splunk Search

Merging rows with same values

keishamtcs
Explorer

Hi Guys,

Need help on merging data. i have two columns ( first and second) which has the same value but instead of showing two different lines, i need to show to only one value for these columns while the 3rd and 4th column remains as individual rows. Please let me know how to resolve this.

StorageArray_serialNumber   TotalPorts  LinkStatusType  StorageArray_Port_topology
92213279                      16                   8                 Link Failure
92213279                      16                 8               LinkUp(F_Port Connected)

My desired output.

StorageArray_serialNumber   TotalPorts  StorageArray_Port_topology  LinkStatusType
                                                     Link Failure            8
92213279                      16       -----------------------------------------------------------
                                                    LinkUp(F_Port Connected)       8                
                                        ---------------------------------------------------------------- 
Tags (1)
0 Karma

somesoni2
Revered Legend

Try something like this

your current search with first output | stats list(*) as * by StorageArray_serialNumber, TotalPorts    
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...