I want to merge data from multiple splunk events into a single field value - does anyone know how?
As an example, lets say we have antivirus data events which contain host name and the virus name. I can do a search to return all of the signatures for a specific host. My goal is to merge those signatures.
where the raw records (simplified) might be:
I want my output to be:
dest=system_1, infections="virus_a, virus_b, virus_c"
the answer appears to be |transaction (thanks) plus |mvcombine
The delimiter (delim=",") does not show up, and i'm still working on that so the result is more legible but the current result is more or less what I wanted.