Splunk Search

How to Combine multiple rows into comma separated single row ?

ibob0304
Communicator

Is it possible to combine multiple rows into one row ?

COLUMN
frow1
frow2
frow3

to something like

COLUMN
frow1,frow2,frow3

Mvcombine combined all the rows to one row but they are not comma separated.
|mvcombine delim="," COLUMN

Tags (4)
1 Solution

somesoni2
Revered Legend

Try like this

your current search giving field COLUMN
| stats list(COLUMN) as COLUMN delim="," | nomv COLUMN

View solution in original post

ibob0304
Communicator
 |mvcombine delim="," COLUMN|   eval MYROW=mvjoin(COLUMN, ", ")
0 Karma

somesoni2
Revered Legend

Try like this

your current search giving field COLUMN
| stats list(COLUMN) as COLUMN delim="," | nomv COLUMN

anooshac
Communicator

Hi,

I have  a similar problem. I want to assign all the values to a token.

<condition label="All">
<set token="Tok_all">"All the values should be should be assigned here"</set>

</condition>

also the values should be delimited with double quotes. (eg: "a","b","c")I tried a lot and i am not able to reach to the solution. do you have any solution for this?

0 Karma

Simon1Dugdale1
Engager
| eval COLUMN = frow1.", ".".frow2.", ".frow3

Using eval and a '.' is one way.

| strcat frow1 ", " frow2 ", " frow3 COLUMN

Using stringcat is another.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Rounding off the Splunk Dashboard Contest

What does a contest-winning Splunk dashboard look like? In this case, it isn't in a browser tab at all. It ...

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

AI &#43; Observability: AI Agents, LLMs, Apps, & Infrastructure The rapid evolution of artificial intelligence ...