Hi, I have exported my search results into a csv file using Export button.
The output result contains a list of Email adresses that are field values.
But, the contents of csv file looks like below:
test@test.com email@sample.com data@test.com.....
whereas I want the output as below:
test@test.com
email@sample.com
data@test.com
I am using the below query for getting the output:
stats values(EMAIL_DATA) AS COMBINED_EMAIL
Output in splunk looks like below:
COMBINED_EMAIL
test@test.com
email@sample.com
data@test.com
Kindly help me with the formatting issue.
Instead of stats values(EMAIL_DATA)
creating a multi-value field, use stats count by EMAIL_DATA
. Then use fields
and/or rename
to format the data however you like.
Add this to the end of your search:
... | mvexpand COMBINED_EMAIL
Instead of stats values(EMAIL_DATA)
creating a multi-value field, use stats count by EMAIL_DATA
. Then use fields
and/or rename
to format the data however you like.
It works fine.