How to convert to multivalue field?

pc1234 — Wed, 12 Oct 2022 00:26:20 GMT

I'm trying to convert a field with multiple results into a multivalue field.

I'm querying a host lookup table that has several hostnames. I'd like to create a single multivalue field containing all the hostnames returned by the inputlookup command separated by a comma. I'm using the makemv command to do this but it returns each host as a separate result instead of a single result with all the hosts separated by commas.

Any suggestions?

here's my query:

| inputlookup host_table

fields hostname
| makemv delim="," hostname

| table hostname

Thanks in advance.

Re: convert to multivalue field

yuanliu — Tue, 11 Oct 2022 23:32:56 GMT

First, please clarify that you want a comma-delimited string as output, not a multivalue field. Is this correct? to get a true multivalue field, use

| inputlookup host_table | stats values(hostname) as hostname

To get one comma-separated text string, do

| inputlookup host_table | stats values(hostname) as hostname | eval hostname = mvjoin(hostname, ",")

This latter output will be single-valued.

topic How to convert to multivalue field? in Splunk Search

How to convert to multivalue field?

Re: convert to multivalue field