Splunk Search

How to Combine multiple rows into comma separated single row ?

ibob0304
Communicator

Is it possible to combine multiple rows into one row ?

COLUMN
frow1
frow2
frow3

to something like

COLUMN
frow1,frow2,frow3

Mvcombine combined all the rows to one row but they are not comma separated.
|mvcombine delim="," COLUMN

Tags (4)
1 Solution

somesoni2
Revered Legend

Try like this

your current search giving field COLUMN
| stats list(COLUMN) as COLUMN delim="," | nomv COLUMN

View solution in original post

ibob0304
Communicator
 |mvcombine delim="," COLUMN|   eval MYROW=mvjoin(COLUMN, ", ")
0 Karma

somesoni2
Revered Legend

Try like this

your current search giving field COLUMN
| stats list(COLUMN) as COLUMN delim="," | nomv COLUMN

anooshac
Communicator

Hi,

I have  a similar problem. I want to assign all the values to a token.

<condition label="All">
<set token="Tok_all">"All the values should be should be assigned here"</set>

</condition>

also the values should be delimited with double quotes. (eg: "a","b","c")I tried a lot and i am not able to reach to the solution. do you have any solution for this?

0 Karma

Simon1Dugdale1
Engager
| eval COLUMN = frow1.", ".".frow2.", ".frow3

Using eval and a '.' is one way.

| strcat frow1 ", " frow2 ", " frow3 COLUMN

Using stringcat is another.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...