Splunk Search

How to Combine multiple rows into comma separated single row ?

ibob0304
Communicator

Is it possible to combine multiple rows into one row ?

COLUMN
frow1
frow2
frow3

to something like

COLUMN
frow1,frow2,frow3

Mvcombine combined all the rows to one row but they are not comma separated.
|mvcombine delim="," COLUMN

Tags (4)
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try like this

your current search giving field COLUMN
| stats list(COLUMN) as COLUMN delim="," | nomv COLUMN

View solution in original post

ibob0304
Communicator
 |mvcombine delim="," COLUMN|   eval MYROW=mvjoin(COLUMN, ", ")
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this

your current search giving field COLUMN
| stats list(COLUMN) as COLUMN delim="," | nomv COLUMN

anooshac
Communicator

Hi,

I have  a similar problem. I want to assign all the values to a token.

<condition label="All">
<set token="Tok_all">"All the values should be should be assigned here"</set>

</condition>

also the values should be delimited with double quotes. (eg: "a","b","c")I tried a lot and i am not able to reach to the solution. do you have any solution for this?

0 Karma

Simon1Dugdale1
Engager
| eval COLUMN = frow1.", ".".frow2.", ".frow3

Using eval and a '.' is one way.

| strcat frow1 ", " frow2 ", " frow3 COLUMN

Using stringcat is another.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...