Splunk Search

How to Combine multiple rows into comma separated single row ?

ibob0304
Communicator

Is it possible to combine multiple rows into one row ?

COLUMN
frow1
frow2
frow3

to something like

COLUMN
frow1,frow2,frow3

Mvcombine combined all the rows to one row but they are not comma separated.
|mvcombine delim="," COLUMN

Tags (4)
1 Solution

somesoni2
Revered Legend

Try like this

your current search giving field COLUMN
| stats list(COLUMN) as COLUMN delim="," | nomv COLUMN

View solution in original post

ibob0304
Communicator
 |mvcombine delim="," COLUMN|   eval MYROW=mvjoin(COLUMN, ", ")
0 Karma

somesoni2
Revered Legend

Try like this

your current search giving field COLUMN
| stats list(COLUMN) as COLUMN delim="," | nomv COLUMN

anooshac
Communicator

Hi,

I have  a similar problem. I want to assign all the values to a token.

<condition label="All">
<set token="Tok_all">"All the values should be should be assigned here"</set>

</condition>

also the values should be delimited with double quotes. (eg: "a","b","c")I tried a lot and i am not able to reach to the solution. do you have any solution for this?

0 Karma

Simon1Dugdale1
Engager
| eval COLUMN = frow1.", ".".frow2.", ".frow3

Using eval and a '.' is one way.

| strcat frow1 ", " frow2 ", " frow3 COLUMN

Using stringcat is another.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...