All Apps and Add-ons

how to use search command combine the 2 rows records into 1 row

mwong
Splunk Employee
Splunk Employee

I run the search and it come up with 2 records with 2 fields common in value. Any idea how to combine the 2 record into 1 record?

sourcetype="AAA"|table A_id, B_id, A_start, A_end, B_start, B_end

0 Karma
1 Solution

daniel_splunk
Splunk Employee
Splunk Employee

From your result, if either A-id or B-id have value but not both, you can use strcat to combine it and then use the stats function to get the result.

For example,
sourcetype="AAA"|strcat A-id B-id combine|table combine, A-start, A-end, B-start, B-end|stats max(*) by combine

View solution in original post

daniel_splunk
Splunk Employee
Splunk Employee

From your result, if either A-id or B-id have value but not both, you can use strcat to combine it and then use the stats function to get the result.

For example,
sourcetype="AAA"|strcat A-id B-id combine|table combine, A-start, A-end, B-start, B-end|stats max(*) by combine

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...