Getting Data In

How do i delimit the multivalued fields in Splunk?

Shashank_87
Explorer

Hi, I have a search which produces a table and one of the column Username contains multiple values. They are kind of aliases for the same user. I need to delimit them using a comma separator. How do i achieve that please?

Username
test1@gmail.com
test2@gmail.com
test3@gmail.com
test4@gmail.com

I want something like this - test1@gmail.com, test2@gmail.com, test3@gmail.com, test4@gmail.com

0 Karma
1 Solution

to4kawa
Ultra Champion
|makeresults
|eval username="test1@gmail.com#test2@gmail.com#test3@gmail.com#test4@gmail.com"
|makemv delim="#" username
|eval result=mvjoin(username,",")

Hi, Try it.

View solution in original post

0 Karma

to4kawa
Ultra Champion
|makeresults
|eval username="test1@gmail.com#test2@gmail.com#test3@gmail.com#test4@gmail.com"
|makemv delim="#" username
|eval result=mvjoin(username,",")

Hi, Try it.

0 Karma

Shashank_87
Explorer

Thanks @to4kawa it worked 🙂

0 Karma
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...