topic Re: Is there a function that concatenates result lines of strings? in Splunk Search

Is there a function that concatenates result lines of strings?

koljalauterbach — Wed, 18 Oct 2017 09:12:56 GMT

Hi everyone!

I would like to format a result into a string and I don't even know where to start and if there even is a function for that ...

My results are a simple list of number/characters:

AD1234
AB2342
GD4787
...

What I would like to have is a formatted string like this:

("AD1234","AB2342","GD4787","...")

Is there a function that concatenates result lines?

Thanks in advance!

gcusello — Wed, 18 Oct 2017 11:36:20 GMT

Hi
you have to use mvcombine and nomv, something like this

index=_internal 
| head 100 
| dedup source  
| table source 
| mvcombine delim=", " source 
| nomv source

Bye.
Giuseppe

cmerriman — Wed, 18 Oct 2017 11:56:33 GMT

Try something like this to add the double quotes and parentheses around the string..

...
|mvcombine delim="\",\"" field_name
|nomv data
|rex field=field_name mode=sed "s/(.*)/(\"\1\")/"

the function |format will format a series like (field=value1) OR (field=value2) OR .... but also works with more complex solutions, also, like when there is more than one field.
https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Format