Getting a comma separate string from values function within stats command

[ramesh]

When I extract the list of values of a field in stats command, the values appear in separate lines making the output sparse and ugly. Is it possible to get the values as a comma separated string so that everything sits in one line?

[raoul]

What you need is to use eval and then the mvjoin() function.

yoursearchhere |
stats values(myField) as myFieldValues by field2 |
eval myFieldValues=mvjoin(myFieldValues, ", ")

[duartet]

Yup that one works as intended! Thanks

[lguinn2]

You could do this by using the makemv command:

yoursearchhere | 
stats values(myField) as myFieldValues by field2 |
makemv delim="," myFieldValues

[justdan23]

Works for me in Splunk 8.0.2, but now I need to add a wildcard prefix and quotes to each value.

[raoul]

I downvoted this post because doesn't work

[lguinn2]

You are right, my apologies.

[raoul]

Actually, this just doesn't work. At any rate when I run such a query I do NOT get the values separated by commas.

Nor would one expect it to based on the documentation of the makemv command which says: Converts a single valued field into a multivalue field by splitting it on a simple string delimiter.