https://community.splunk.com/t5/Splunk-Search/Getting-a-comma-separate-string-from-values-function-within/m-p/73690#M18471 <P>I downvoted this post because doesn't work</P> Thu, 27 Apr 2017 13:41:12 GMT raoul 2017-04-27T13:41:12Z https://community.splunk.com/t5/Splunk-Search/Getting-a-comma-separate-string-from-values-function-within/m-p/73687#M18468 <P>When I extract the list of values of a field in stats command, the values appear in separate lines making the output sparse and ugly. Is it possible to get the values as a comma separated string so that everything sits in one line?</P> Tue, 12 Jun 2012 22:57:37 GMT https://community.splunk.com/t5/Splunk-Search/Getting-a-comma-separate-string-from-values-function-within/m-p/73687#M18468 ramesh 2012-06-12T22:57:37Z https://community.splunk.com/t5/Splunk-Search/Getting-a-comma-separate-string-from-values-function-within/m-p/73688#M18469 <P>You could do this by using the makemv command:</P> <PRE><CODE>yoursearchhere | stats values(myField) as myFieldValues by field2 | makemv delim="," myFieldValues </CODE></PRE> Mon, 18 Jun 2012 23:33:19 GMT https://community.splunk.com/t5/Splunk-Search/Getting-a-comma-separate-string-from-values-function-within/m-p/73688#M18469 lguinn2 2012-06-18T23:33:19Z https://community.splunk.com/t5/Splunk-Search/Getting-a-comma-separate-string-from-values-function-within/m-p/73689#M18470 <P>Actually, this just doesn't work. At any rate when I run such a query I do NOT get the values separated by commas.</P> <P>Nor would one expect it to based on the documentation of the <CODE>makemv</CODE> command which says: <EM>Converts a single valued field into a multivalue field by splitting it on a simple string delimiter</EM>. </P> Thu, 27 Apr 2017 13:40:37 GMT https://community.splunk.com/t5/Splunk-Search/Getting-a-comma-separate-string-from-values-function-within/m-p/73689#M18470 raoul 2017-04-27T13:40:37Z https://community.splunk.com/t5/Splunk-Search/Getting-a-comma-separate-string-from-values-function-within/m-p/73690#M18471 <P>I downvoted this post because doesn't work</P> Thu, 27 Apr 2017 13:41:12 GMT https://community.splunk.com/t5/Splunk-Search/Getting-a-comma-separate-string-from-values-function-within/m-p/73690#M18471 raoul 2017-04-27T13:41:12Z https://community.splunk.com/t5/Splunk-Search/Getting-a-comma-separate-string-from-values-function-within/m-p/73691#M18472 <P>What you need is to use <CODE>eval</CODE> and then the <CODE>mvjoin()</CODE> function. </P> <PRE><CODE>yoursearchhere | stats values(myField) as myFieldValues by field2 | eval myFieldValues=mvjoin(myFieldValues, ", ") </CODE></PRE> Thu, 27 Apr 2017 13:55:38 GMT https://community.splunk.com/t5/Splunk-Search/Getting-a-comma-separate-string-from-values-function-within/m-p/73691#M18472 raoul 2017-04-27T13:55:38Z https://community.splunk.com/t5/Splunk-Search/Getting-a-comma-separate-string-from-values-function-within/m-p/73692#M18473 <P>You are right, my apologies. </P> Tue, 02 May 2017 01:47:08 GMT https://community.splunk.com/t5/Splunk-Search/Getting-a-comma-separate-string-from-values-function-within/m-p/73692#M18473 lguinn2 2017-05-02T01:47:08Z https://community.splunk.com/t5/Splunk-Search/Getting-a-comma-separate-string-from-values-function-within/m-p/73693#M18474 <P>Yup that one works as intended! Thanks</P> Fri, 28 Feb 2020 12:29:26 GMT https://community.splunk.com/t5/Splunk-Search/Getting-a-comma-separate-string-from-values-function-within/m-p/73693#M18474 duartet 2020-02-28T12:29:26Z https://community.splunk.com/t5/Splunk-Search/Getting-a-comma-separate-string-from-values-function-within/m-p/526550#M148611 <P>Works for me in Splunk 8.0.2, but now I need to add a wildcard prefix and quotes to each value.</P> Mon, 26 Oct 2020 23:11:05 GMT https://community.splunk.com/t5/Splunk-Search/Getting-a-comma-separate-string-from-values-function-within/m-p/526550#M148611 justdan23 2020-10-26T23:11:05Z