Splunk Search

Getting a comma separate string from values function within stats command

ramesh
Engager

When I extract the list of values of a field in stats command, the values appear in separate lines making the output sparse and ugly. Is it possible to get the values as a comma separated string so that everything sits in one line?

raoul
Path Finder

What you need is to use eval and then the mvjoin() function.

yoursearchhere |
stats values(myField) as myFieldValues by field2 |
eval myFieldValues=mvjoin(myFieldValues, ", ")

duartet
Path Finder

Yup that one works as intended! Thanks

0 Karma

lguinn2
Legend

You could do this by using the makemv command:

yoursearchhere | 
stats values(myField) as myFieldValues by field2 |
makemv delim="," myFieldValues

justdan23
Path Finder

Works for me in Splunk 8.0.2, but now I need to add a wildcard prefix and quotes to each value.

0 Karma

raoul
Path Finder

I downvoted this post because doesn't work

0 Karma

lguinn2
Legend

You are right, my apologies.

0 Karma

raoul
Path Finder

Actually, this just doesn't work. At any rate when I run such a query I do NOT get the values separated by commas.

Nor would one expect it to based on the documentation of the makemv command which says: Converts a single valued field into a multivalue field by splitting it on a simple string delimiter.

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...