Splunk Search

Aggregate the column data

bharat149
Explorer

i have a query that show the data in table form i have to merge the row

Query :
my search query |
| timechart span=5m count by message
| eval time=strftime(_time,"%Y-%m-%d %H:%M:%S")
|untable time message count | xyseries message time count

It gives the date in a table form
message time1 time2 time3
a/b/c 1 2 3
abc/1/x 0 1 4
abc/2/x 0 1 2
abc/3/x 0 2 4

i have to merge the row and change the metric to

message time1 time2 time3
a/b/c 1 2 3
abc/x 0 4 10

i have tried rex expression also but i didn't work

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

It would help to know the rex command you tried. Perhaps this will work for you.

my search query |
| rex mode=sed field=message "s'abc/.*'abc/x'"
| timechart span=5m count by message
| eval time=strftime(_time,"%Y-%m-%d %H:%M:%S")
|untable time message count | xyseries message time count
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...