Splunk Search

Combine 2 values of multi value fields

Shashank_87
Explorer

Hi, I am looking to merge 2 values of a multi valued fields and put it in a table. For example my current query is extracting data like this -

  1. Business Exception while rescheduling order 1103
  2. ICOMS Business Exception. 1103
  3. Business Exception 665

Now if you see 1st and 2nd row are actually same event because the description tag which i am extracting comes twice sometimes.
I have tried combining them using mvcombine and nomv but then how would i extract _time fields as well.
Query -

index=my_prod source="/var/log/test.txt" mywebservice (error OR exception OR critical OR failure)
| rex field=_raw "description>(?[^<]+)" max_match=2
| stats count by Exception
| sort - count
| mvcombine delim=" | " Exception
| nomv Exception

What i want to do is also add _time field in the table and that event should come as a single row with count as 1.

Let me know if someone can help.

0 Karma

to4kawa
Ultra Champion
...
| stats  min(_time) as _time values(Exception) as Exception
| eval Exception=mvjoin(Exception,"|")

please use code sample and check your post.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...