Hey guys,
thanks for taking time out of your day. I'm relatively new to Splunk and just need help with formatting some output from a search. Essentially, this is what I have:
source=sourcetype | fieldA=*, fieldB=* | table _time, fieldA, fieldB | sort fieldA => that outputs this:
_time | fieldA | fieldB
datetime | JohnDoe | 123456
datetime | JohnDoe | 7890
I'd like it to output:
_time | fieldA | fieldB
datetime | JohnDoe | 123456, 7890
I'm just having some trouble with the syntax. Thanks again for your time!
Would something like the following meet your needs?
source=sourcetype
| stats values(fieldB) by fieldA
or maybe
source=sourcetype
| stats values(fieldB), values(_time) as time by fieldA
| convert ctime(time)
Would something like the following meet your needs?
source=sourcetype
| stats values(fieldB) by fieldA
or maybe
source=sourcetype
| stats values(fieldB), values(_time) as time by fieldA
| convert ctime(time)
That worked beautifully! Thanks so much, Sam!
glad it worked for you! I converted the comment to an answer for future folks.
Hi @riffe88,
Glad that this answer was able to help ya. Would you mind approving it for us so that future users will know it's the correct solution? Thanks!
Is datetime exactly the same for those two events?
No, but fieldA is. Basically, fieldA generates a lot of the same entry with different values for that entry going into fieldB. I'm doing file integrity monitoring, so the return is like this:
test.txt | hash=1348571934854719328741129
test.txt | hash=9873249857345098809453899
I'm trying to consolidate the different values of hashes into one multivalue cell for each unique filename.