Splunk Search

Concatenating values from one field

Sailesh6891
Engager

How can we concatenate values from one field and put it in a new variable with commas.

e.g If I run a search , I get number of host in host field. I want to concatenate them all in one field separated by commas.

Labels (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Do you mean you want to concatenate host values from all events collectively, not just from each individual event?  If that's all you want, you can do

 

<your_search>
| stats values(host) AS host
| eval newfield = mvjoin(host, ",")

 

If you want a new field alongside other fields in events, use eventstats instead of stats

 

<your_search>
| eventstats values(host) AS newfield
| eval newfield = mvjoin(newfield, ",")

 

 

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

 

| eval newField=mvjoin(host, ",")

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

Sailesh6891
Engager

This does not work. newField have the same values as host field. Its not concatenating.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Do you mean you want to concatenate host values from all events collectively, not just from each individual event?  If that's all you want, you can do

 

<your_search>
| stats values(host) AS host
| eval newfield = mvjoin(host, ",")

 

If you want a new field alongside other fields in events, use eventstats instead of stats

 

<your_search>
| eventstats values(host) AS newfield
| eval newfield = mvjoin(newfield, ",")

 

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Sailesh6891 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The values are *supposed* to be the same in the new field, except with commas added.

Please share sanitized examples of what results you have now and what you want.

---
If this reply helps you, Karma would be appreciated.
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Sailesh6891 ,

you could try somethng like this:

<your_search>
| stats values(host) AS host BY index
| nomv host

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...