topic Re: Values function separator in Splunk Search

Values function separator

ERICKWONG — Tue, 10 Sep 2013 09:41:57 GMT

My query is the following
index="_internal" | table host | stats values(host)

output:

values(host)

host1

host2

I want the output is the following

output:

values(host)

host1,

host2

Is there any method to do ?

Ayn — Tue, 10 Sep 2013 09:47:56 GMT

The first row is a header row so it'd be misleading to put an actual field value there. You can rename the text in the header if you want:

index=_internal | stats values(host) as someothername

(I removed the table command in your search because you don't need it)

ERICKWONG — Tue, 10 Sep 2013 09:54:23 GMT

I want to add a "comma" in my result

host1,host2

ERICKWONG — Tue, 10 Sep 2013 09:55:04 GMT

I want to add a "comma" in my result

host1,host2

Is there any function to do?

Ayn — Tue, 10 Sep 2013 10:30:23 GMT

So, you want to have one row of comma-separated values instead of separate ones? If so, you could do

index=_internal | stats values(host) as somename | eval somename=mvjoin(somename,",")

ERICKWONG — Wed, 11 Sep 2013 01:32:26 GMT

index=_internal | stats values(host) as somename | eval somename=mvjoin(somename,",")

It works@@, Thx~

ERICKWONG — Wed, 11 Sep 2013 06:13:30 GMT

Is there any method to add a line break between?
Not only a comma.

output:
host1,
host2,
host3