https://community.splunk.com/t5/Splunk-Search/get-the-single-value-out-of-multiple/m-p/96737#M25025 <P>You can do this by turning the Location into a multivalued field, and then using <CODE>stats values</CODE> to get only the distinct values for each Name. </P> <PRE><CODE>&lt;your search here&gt; | eval Location=split(Location,",") | stats values(Location) as Location by Name </CODE></PRE> <P>This makes a couple assumptions -- each Name value only appears in one row in your search results, and the comma character never makes an appearance in your <EM>actual</EM> Location values. </P> Sun, 21 Oct 2012 04:56:33 GMT sideview 2012-10-21T04:56:33Z https://community.splunk.com/t5/Splunk-Search/get-the-single-value-out-of-multiple/m-p/96732#M25020 <P>Hi,</P> <P>I have the input like this :</P> <P>Name Location</P> <HR /> <P>abhay kol,mumbai,kol<BR /> murari mumbai,chennai<BR /> trid delhi,delhi<BR /> xyz haridwar</P> <P>My output should be like :</P> <P>Name Location</P> <HR /> <P>abhay kol,mumbai<BR /> murari mumbai,chennai<BR /> trid delhi<BR /> xyz haridwar</P> <P>If any double data is there in Location filed then it should be removed, I want to display only single value !!</P> <P>Please help !!</P> <P>Thanks<BR /> Abhay</P> Fri, 19 Oct 2012 19:33:18 GMT https://community.splunk.com/t5/Splunk-Search/get-the-single-value-out-of-multiple/m-p/96732#M25020 abhayneilam 2012-10-19T19:33:18Z https://community.splunk.com/t5/Splunk-Search/get-the-single-value-out-of-multiple/m-p/96733#M25021 <P>Could you please also post</P> <P>a) some sample events<BR /> b) the search that produces the first table</P> <P>/k</P> Fri, 19 Oct 2012 20:21:33 GMT https://community.splunk.com/t5/Splunk-Search/get-the-single-value-out-of-multiple/m-p/96733#M25021 kristian_kolb 2012-10-19T20:21:33Z https://community.splunk.com/t5/Splunk-Search/get-the-single-value-out-of-multiple/m-p/96734#M25022 <P>Ok, another off the cuff search.</P> <P><CODE></CODE><PRE><CODE><BR /> ...| makemv delim="," Location | dedup Location | eval Location =mvjoin(Location ,",") | table Name, Location<BR /> </CODE></PRE></P> <P>or <BR /> <CODE></CODE><PRE><CODE><BR /> ...| makemv delim="," Location | dedup Location | eval Location=if(Name=Name,mvjoin(Location ,","),Location) | table Name, Location<BR /> </CODE></PRE></P> Fri, 19 Oct 2012 20:22:37 GMT https://community.splunk.com/t5/Splunk-Search/get-the-single-value-out-of-multiple/m-p/96734#M25022 bmacias84 2012-10-19T20:22:37Z https://community.splunk.com/t5/Splunk-Search/get-the-single-value-out-of-multiple/m-p/96735#M25023 <P>This is my search: </P> <P>index="maa" | rex max_match=9999 field="Location" (?<ONE>(?i)"(delhi|mumbai|kol|bu is)")|eval final=mvjoin(ONE,",")| table Name Age Location final | sort final + desc</ONE></P> Fri, 19 Oct 2012 20:29:27 GMT https://community.splunk.com/t5/Splunk-Search/get-the-single-value-out-of-multiple/m-p/96735#M25023 abhayneilam 2012-10-19T20:29:27Z https://community.splunk.com/t5/Splunk-Search/get-the-single-value-out-of-multiple/m-p/96736#M25024 <P>my input has some blank value also in the Location field:</P> <P>Name Location</P> <HR /> <P>abhay kol,mumbai,kol<BR /> murari mumbai,chennai<BR /> trid delhi,delhi<BR /> xyz haridwar<BR /> abc <BR /> mno </P> <P>my output should be like this :</P> <P>Name Location<BR /> abhay kol,mumbai<BR /> murari mumbai,chennai<BR /> trid delhi<BR /> xyz haridwar<BR /> abc <BR /> mno</P> Fri, 19 Oct 2012 20:38:33 GMT https://community.splunk.com/t5/Splunk-Search/get-the-single-value-out-of-multiple/m-p/96736#M25024 abhayneilam 2012-10-19T20:38:33Z https://community.splunk.com/t5/Splunk-Search/get-the-single-value-out-of-multiple/m-p/96737#M25025 <P>You can do this by turning the Location into a multivalued field, and then using <CODE>stats values</CODE> to get only the distinct values for each Name. </P> <PRE><CODE>&lt;your search here&gt; | eval Location=split(Location,",") | stats values(Location) as Location by Name </CODE></PRE> <P>This makes a couple assumptions -- each Name value only appears in one row in your search results, and the comma character never makes an appearance in your <EM>actual</EM> Location values. </P> Sun, 21 Oct 2012 04:56:33 GMT https://community.splunk.com/t5/Splunk-Search/get-the-single-value-out-of-multiple/m-p/96737#M25025 sideview 2012-10-21T04:56:33Z