topic Re: How can I concatenate a single field's value across multiple rows into a single string? in Splunk Search

How can I concatenate a single field's value across multiple rows into a single string?

jeskandarian — Thu, 15 Oct 2015 23:24:46 GMT

Search:

index=exp eventName="business:SelfServ-ChangeTrip" ChangeBookingEventType=ChangeBookingPayloadChunk hotelChangePayloadId="24c51841-8188-448b-9f4a-26f978ae4af9" 
| sort chunkSequence 
| fields payload

Results:

date       payload
XXXX       String 1-
XXXX       String 2-

I'd like the result to be:

date       payload
XXXX       String 1-String 2-

Obviously I don't care about the date, but I can't seem to get rid of it with fields -_* without messing up the entire search.

Re: How can I concatenate a single field's value across multiple rows into a single string?

somesoni2 — Fri, 16 Oct 2015 00:24:26 GMT

Do something like this

 index=exp eventName="business:SelfServ-ChangeTrip" ChangeBookingEventType=ChangeBookingPayloadChunk hotelChangePayloadId="24c51841-8188-448b-9f4a-26f978ae4af9" 
 | sort chunkSequence | stats list(payload) as payload | nomv payload

Re: How can I concatenate a single field's value across multiple rows into a single string?

jeskandarian — Wed, 21 Oct 2015 17:52:31 GMT

This worked great except when the payload field contains a comma. When it runs into a comma the resulting string gets truncated. I imagine I can do something to "list(payload)" but not sure.

Re: How can I concatenate a single field's value across multiple rows into a single string?

woodcock — Thu, 22 Oct 2015 13:37:44 GMT

Works for me:

|noop|stats count as field|eval field="a,b,c,d,e" | makemv delim="," field | rex field=field mode=sed "s/c/c,/" | nomv field