Splunk Search

How to edit my search to reformat results in a table?

Tim_1
Path Finder

Hi all,

I'm new to Splunk, and been stuck at trying to format a table of results.

I currently have the a raw results table that looks something like this:

VendorID     VendorCoOrd         Products
 1001          (120)                      one
 1001          (120)                      two
 1001          (120)                      three
 1001          (1)                        one
 1001          (2)                        one
 1002          (1)                        one
...

What I've currently achieved:

VendorID     VendorCoOrd         Products
 1001          (120)                      one
               (1)                        two
               (2)                        three
                                          one
                                          one
 1002          (1)                        one
...

Using the following query:

| stats values(VendorCoOrd) AS VendorCoOrd, values(product_name) AS Products BY VendorID

However, what I want to achieve is this:

VendorID     VendorCoOrd         Products
 1001          (120)                      one
                                          two
                                          three
               (1)                        one
               (2)                        one
 1002          (1)                        one
...

Any advice on how to achieve this result?

Thanks.

0 Karma

sundareshr
Legend

Try this

| stats values(product_name) AS Products BY VendorID VendorCoOrd
0 Karma

Tim_1
Path Finder

Hi @sundareshr

Thanks for the suggestion, but I have tried that before and it only results in the following:

VendorID     VendorCoOrd         Products
 1001          (120)                      one
                                          two
                                          three
 1001          (1)                        one
 1001          (2)                        one
 1002          (1)                        one
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...