Splunk Search

How can I concatenate a single field's value across multiple rows into a single string?

jeskandarian
Engager

Search:

index=exp eventName="business:SelfServ-ChangeTrip" ChangeBookingEventType=ChangeBookingPayloadChunk hotelChangePayloadId="24c51841-8188-448b-9f4a-26f978ae4af9" 
| sort chunkSequence 
| fields payload

Results:

date       payload
XXXX       String 1-
XXXX       String 2-

I'd like the result to be:

date       payload
XXXX       String 1-String 2-

Obviously I don't care about the date, but I can't seem to get rid of it with fields -_* without messing up the entire search.

0 Karma
1 Solution

somesoni2
Revered Legend

Do something like this

 index=exp eventName="business:SelfServ-ChangeTrip" ChangeBookingEventType=ChangeBookingPayloadChunk hotelChangePayloadId="24c51841-8188-448b-9f4a-26f978ae4af9" 
 | sort chunkSequence | stats list(payload) as payload | nomv payload

View solution in original post

somesoni2
Revered Legend

Do something like this

 index=exp eventName="business:SelfServ-ChangeTrip" ChangeBookingEventType=ChangeBookingPayloadChunk hotelChangePayloadId="24c51841-8188-448b-9f4a-26f978ae4af9" 
 | sort chunkSequence | stats list(payload) as payload | nomv payload

jeskandarian
Engager

This worked great except when the payload field contains a comma. When it runs into a comma the resulting string gets truncated. I imagine I can do something to "list(payload)" but not sure.

0 Karma

woodcock
Esteemed Legend

Works for me:

|noop|stats count as field|eval field="a,b,c,d,e" | makemv delim="," field | rex field=field mode=sed "s/c/c,/" | nomv field
0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...