https://community.splunk.com/t5/Splunk-Search/Replace-space-in-multi-value-filed-with-comma/m-p/58630#M14365 <P>Hi jonuwz,</P> <P>i have field input_source_file and I need to make it a comma separated field, i followed your instruction but not able to get the result. </P> <P><STRONG>data in input_source_file is</STRONG> : aaaa bbbb</P> <P><STRONG>desired</STRONG>: aaaa,bbbb</P> <P>My query is:</P> <P>sourcetype="mslogs" ("MPSVCCMN_10081" OR "DBG_21430") earliest="12/5/2012:16:08:00" latest="12/5/2013:16:16:00" | rex field=_raw "Mapping service is running [(?<MAPPING_NAME>(.+))]\sdep" | transaction source|search mapping_name=src_join_tgt_cachetuned*<EM>| rex mode=sed field=input_source_file "s/ /,/g" |</EM>* table mapping_name,input_source_file.</MAPPING_NAME></P> <P>sample event:</P> <P>2012-12-05 20:19:17 INFO: [MPSVCCMN_10081] Mapping service is running [xxxx] deployed in [yyyy]</P> <P>2012-12-05 20:19:17 INFO: READER_1_1_1, DBG_21430, Reading data from input source file [aaaa]</P> <P>2012-12-05 20:19:17 INFO: READER_1_2_1, DBG_21430, Reading data from input source file [bbbb]</P> Mon, 28 Sep 2020 14:24:02 GMT trkalva 2020-09-28T14:24:02Z https://community.splunk.com/t5/Splunk-Search/Replace-space-in-multi-value-filed-with-comma/m-p/58628#M14363 <P>Hi ,</P> <P>Can we replace space in multi-value filed with comma ..?</P> <P>Ex :</P> <P>field : host<BR /> current Values : server1 server2 server3 </P> <P>Required Values : server1,server2,server3</P> <P>Thanks ...</P> Tue, 12 Mar 2013 14:26:18 GMT https://community.splunk.com/t5/Splunk-Search/Replace-space-in-multi-value-filed-with-comma/m-p/58628#M14363 Ravan 2013-03-12T14:26:18Z https://community.splunk.com/t5/Splunk-Search/Replace-space-in-multi-value-filed-with-comma/m-p/58629#M14364 <P>Yep :</P> <PRE><CODE>... | rex mode=sed field=host "s/ /,/g" | ... </CODE></PRE> Tue, 12 Mar 2013 14:54:10 GMT https://community.splunk.com/t5/Splunk-Search/Replace-space-in-multi-value-filed-with-comma/m-p/58629#M14364 jonuwz 2013-03-12T14:54:10Z https://community.splunk.com/t5/Splunk-Search/Replace-space-in-multi-value-filed-with-comma/m-p/58630#M14365 <P>Hi jonuwz,</P> <P>i have field input_source_file and I need to make it a comma separated field, i followed your instruction but not able to get the result. </P> <P><STRONG>data in input_source_file is</STRONG> : aaaa bbbb</P> <P><STRONG>desired</STRONG>: aaaa,bbbb</P> <P>My query is:</P> <P>sourcetype="mslogs" ("MPSVCCMN_10081" OR "DBG_21430") earliest="12/5/2012:16:08:00" latest="12/5/2013:16:16:00" | rex field=_raw "Mapping service is running [(?<MAPPING_NAME>(.+))]\sdep" | transaction source|search mapping_name=src_join_tgt_cachetuned*<EM>| rex mode=sed field=input_source_file "s/ /,/g" |</EM>* table mapping_name,input_source_file.</MAPPING_NAME></P> <P>sample event:</P> <P>2012-12-05 20:19:17 INFO: [MPSVCCMN_10081] Mapping service is running [xxxx] deployed in [yyyy]</P> <P>2012-12-05 20:19:17 INFO: READER_1_1_1, DBG_21430, Reading data from input source file [aaaa]</P> <P>2012-12-05 20:19:17 INFO: READER_1_2_1, DBG_21430, Reading data from input source file [bbbb]</P> Mon, 28 Sep 2020 14:24:02 GMT https://community.splunk.com/t5/Splunk-Search/Replace-space-in-multi-value-filed-with-comma/m-p/58630#M14365 trkalva 2020-09-28T14:24:02Z