splunk query to concatenate status code for every hour

Question

index=abc sourcetype=firststream-* env=* module=API type=Error error_level=fatal serviceName=MyService |bin _time span=1h | stats count by _time,serviceName,httpStatusCode

output is displayed for every httpStatuscode in that hour. Instead, I want to concatenate httpStatusCode for that hour and display in a single column.

Answer 1

Try this.

index=abc sourcetype=firststream-* env=* module=API type=Error error_level=fatal serviceName=MyService 
| bin _time span=1h 
| stats count values(httpStatusCode) as httpStatusCode by _time, serviceName
| table _time, serviceName, httpStatusCode