Getting Data In

How do i delimit the multivalued fields in Splunk?

Explorer

Hi, I have a search which produces a table and one of the column Username contains multiple values. They are kind of aliases for the same user. I need to delimit them using a comma separator. How do i achieve that please?

Username
test1@gmail.com
test2@gmail.com
test3@gmail.com
test4@gmail.com

I want something like this - test1@gmail.com, test2@gmail.com, test3@gmail.com, test4@gmail.com

0 Karma
1 Solution

SplunkTrust
SplunkTrust
|makeresults
|eval username="test1@gmail.com#test2@gmail.com#test3@gmail.com#test4@gmail.com"
|makemv delim="#" username
|eval result=mvjoin(username,",")

Hi, Try it.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust
|makeresults
|eval username="test1@gmail.com#test2@gmail.com#test3@gmail.com#test4@gmail.com"
|makemv delim="#" username
|eval result=mvjoin(username,",")

Hi, Try it.

View solution in original post

0 Karma

Explorer

Thanks @to4kawa it worked 🙂

0 Karma