topic Re: How to Combine multiple rows into comma separated single row ? in Splunk Search

How to Combine multiple rows into comma separated single row ?

ibob0304 — Wed, 17 May 2017 16:07:59 GMT

Is it possible to combine multiple rows into one row ?

COLUMN
frow1
frow2
frow3

to something like

COLUMN
frow1,frow2,frow3

Mvcombine combined all the rows to one row but they are not comma separated.
|mvcombine delim="," COLUMN

Re: How to Combine multiple rows into comma separated single row ?

Simon1Dugdale1 — Wed, 17 May 2017 16:38:01 GMT

| eval COLUMN = frow1.", ".".frow2.", ".frow3

Using eval and a '.' is one way.

| strcat frow1 ", " frow2 ", " frow3 COLUMN

Using stringcat is another.

Re: How to Combine multiple rows into comma separated single row ?

somesoni2 — Wed, 17 May 2017 16:53:32 GMT

Try like this

your current search giving field COLUMN
| stats list(COLUMN) as COLUMN delim="," | nomv COLUMN

Re: How to Combine multiple rows into comma separated single row ?

ibob0304 — Wed, 17 May 2017 17:04:18 GMT

 |mvcombine delim="," COLUMN|   eval MYROW=mvjoin(COLUMN, ", ")

Re: How to Combine multiple rows into comma separated single row ?

anooshac — Tue, 25 May 2021 06:18:04 GMT

Hi,

I have a similar problem. I want to assign all the values to a token.

<condition label="All">
<set token="Tok_all">"All the values should be should be assigned here"</set>

</condition>

also the values should be delimited with double quotes. (eg: "a","b","c")I tried a lot and i am not able to reach to the solution. do you have any solution for this?