topic Concatenating values from one field in Splunk Search

Concatenating values from one field

Sailesh6891 — Mon, 16 Dec 2024 14:39:14 GMT

How can we concatenate values from one field and put it in a new variable with commas.

e.g If I run a search , I get number of host in host field. I want to concatenate them all in one field separated by commas.

gcusello — Mon, 16 Dec 2024 14:45:53 GMT

you could try somethng like this:

<your_search> | stats values(host) AS host BY index | nomv host

Ciao.

Giuseppe

richgalloway — Mon, 16 Dec 2024 14:57:48 GMT

| eval newField=mvjoin(host, ",")

Sailesh6891 — Mon, 16 Dec 2024 15:55:40 GMT

This does not work. newField have the same values as host field. Its not concatenating.

richgalloway — Mon, 16 Dec 2024 16:43:33 GMT

The values are *supposed* to be the same in the new field, except with commas added.

Please share sanitized examples of what results you have now and what you want.

yuanliu — Tue, 17 Dec 2024 03:42:40 GMT

Do you mean you want to concatenate host values from all events collectively, not just from each individual event? If that's all you want, you can do

<your_search> | stats values(host) AS host | eval newfield = mvjoin(host, ",")

If you want a new field alongside other fields in events, use eventstats instead of stats

<your_search> | eventstats values(host) AS newfield | eval newfield = mvjoin(newfield, ",")

gcusello — Fri, 20 Dec 2024 16:32:54 GMT

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉