Merging data from multiple events into a single field

[tchmielarski]

I want to merge data from multiple splunk events into a single field value - does anyone know how?
As an example, lets say we have antivirus data events which contain host name and the virus name. I can do a search to return all of the signatures for a specific host. My goal is to merge those signatures.

where the raw records (simplified) might be:
system_1, virus_a
system_1, virus_b
system_1, virus_c
system_2, virus_b

I want my output to be:
dest=system_1, infections="virus_a, virus_b, virus_c"

[tchmielarski]

the answer appears to be |transaction (thanks) plus |mvcombine
The delimiter (delim=",") does not show up, and i'm still working on that so the result is more legible but the current result is more or less what I wanted.

example:
.... |transaction dest_host maxspan=7d maxpause=7d | mvcombine delim="," signature

[thinman]

Hi,

look for the transaction command basically adding to you search line:
" | transaction dest "

Don´t forget to include the pipe

Look on: Transaction definition

By the way don't forget to tag your fields!