https://community.splunk.com/t5/Splunk-Search/Convert-multiple-value-to-single-value/m-p/559253#M158898 <P>I want to map multiple value field to one single value field.</P><P>Ex:</P><P>COL1&nbsp; &nbsp; &nbsp;|&nbsp; &nbsp; &nbsp;COL2</P><P>VAL1&nbsp; &nbsp; &nbsp;|&nbsp; &nbsp; &nbsp;Val11</P><P>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Val12</P><P>VAL2&nbsp; &nbsp; &nbsp;|&nbsp; &nbsp; &nbsp;Val21</P><P>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Val22</P><P>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Val23</P><P>And the output I want is:</P><P>COL1&nbsp; &nbsp; &nbsp;|&nbsp; &nbsp; &nbsp;COL2</P><P>VAL1&nbsp; &nbsp; &nbsp;|&nbsp; &nbsp; &nbsp;Val11,VAL12</P><P>VAL1&nbsp; &nbsp; &nbsp;|&nbsp; &nbsp; &nbsp;Val21,VAL22,VAL23</P><P>&nbsp;</P> Tue, 13 Jul 2021 12:05:09 GMT abhishekpatel2 2021-07-13T12:05:09Z https://community.splunk.com/t5/Splunk-Search/Convert-multiple-value-to-single-value/m-p/559253#M158898 <P>I want to map multiple value field to one single value field.</P><P>Ex:</P><P>COL1&nbsp; &nbsp; &nbsp;|&nbsp; &nbsp; &nbsp;COL2</P><P>VAL1&nbsp; &nbsp; &nbsp;|&nbsp; &nbsp; &nbsp;Val11</P><P>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Val12</P><P>VAL2&nbsp; &nbsp; &nbsp;|&nbsp; &nbsp; &nbsp;Val21</P><P>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Val22</P><P>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Val23</P><P>And the output I want is:</P><P>COL1&nbsp; &nbsp; &nbsp;|&nbsp; &nbsp; &nbsp;COL2</P><P>VAL1&nbsp; &nbsp; &nbsp;|&nbsp; &nbsp; &nbsp;Val11,VAL12</P><P>VAL1&nbsp; &nbsp; &nbsp;|&nbsp; &nbsp; &nbsp;Val21,VAL22,VAL23</P><P>&nbsp;</P> Tue, 13 Jul 2021 12:05:09 GMT https://community.splunk.com/t5/Splunk-Search/Convert-multiple-value-to-single-value/m-p/559253#M158898 abhishekpatel2 2021-07-13T12:05:09Z https://community.splunk.com/t5/Splunk-Search/Convert-multiple-value-to-single-value/m-p/559256#M158899 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/230872">@abhishekpatel2</a>&nbsp;</P><P>Can you try this?</P><LI-CODE lang="markup">&lt;your_search_goes_here&gt; | eval new_COL2=mvjoin(COL2,",") | table COL1 new_COL2</LI-CODE><P>---</P><P>An upvote would be appreciated and Accept solution if this reply helps!</P> Tue, 13 Jul 2021 12:17:17 GMT https://community.splunk.com/t5/Splunk-Search/Convert-multiple-value-to-single-value/m-p/559256#M158899 venkatasri 2021-07-13T12:17:17Z