https://community.splunk.com/t5/Getting-Data-In/What-is-the-default-delimiter-for-multivalue-fields-in-Splunk/m-p/151637#M30854 <P>The delimiters used by makemv etc are instructions on how to take a string and identify multiple values within it. In-memory, there simply multiple string values for the field, without any delimeters. </P> <P>When we serialize the multivalue fields to csv, typically there are two reprsentations, one representation acts as a hint that there is a multivalue field, and the other representation is newline-delimited. This is true for data passed to a python search command, or when using the <CODE>|outputcsv</CODE> command. I'm not familiar with what you get when using the in-gui "export" feature with multivalue fields.</P> <P>In the current implementation, the system actually tracks a single-value string and a multi-value set of values for a field that is multivalue, so we may provide the single-value string when exporting even though we will ignore it. (If relevant, this is an implementation wart which will eventually go away.) </P> Sat, 04 Oct 2014 11:48:14 GMT jrodman 2014-10-04T11:48:14Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-default-delimiter-for-multivalue-fields-in-Splunk/m-p/151636#M30853 <P>Hi guys,</P> <P>i just want to know the default delimiter for multivalue field in splunk<BR /> when i export a table to a csv.file<BR /> if the multivalue field is splunk generated , i can see the values are line by line in its csv cell<BR /> but if it generated manually , such as the following : </P> <P>| eval cfxA=cfsnA."///".cfmnA."///".cfszA<BR /> | makemv delim="///" cfxA</P> <P>i can only see the values are all in the same line and delimited by "///"<BR /> who can tell me which delimiter could let them displayed line by line , please ?</P> Sat, 04 Oct 2014 02:52:27 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-default-delimiter-for-multivalue-fields-in-Splunk/m-p/151636#M30853 gfs2277 2014-10-04T02:52:27Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-default-delimiter-for-multivalue-fields-in-Splunk/m-p/151637#M30854 <P>The delimiters used by makemv etc are instructions on how to take a string and identify multiple values within it. In-memory, there simply multiple string values for the field, without any delimeters. </P> <P>When we serialize the multivalue fields to csv, typically there are two reprsentations, one representation acts as a hint that there is a multivalue field, and the other representation is newline-delimited. This is true for data passed to a python search command, or when using the <CODE>|outputcsv</CODE> command. I'm not familiar with what you get when using the in-gui "export" feature with multivalue fields.</P> <P>In the current implementation, the system actually tracks a single-value string and a multi-value set of values for a field that is multivalue, so we may provide the single-value string when exporting even though we will ignore it. (If relevant, this is an implementation wart which will eventually go away.) </P> Sat, 04 Oct 2014 11:48:14 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-default-delimiter-for-multivalue-fields-in-Splunk/m-p/151637#M30854 jrodman 2014-10-04T11:48:14Z