Splunk Search

How to concatenate Dynamic multivalue fields to single value fields?

wealot
Explorer

Hi all,

I have events coming in that have multivalue fields, but not always the same fields are multivalue. I want all the fields in the events resulting from a search to be concatenated to single value field.

Example:

Result now shows:

dest       xyz

                fff

Result should show:

dest   xyz [delimiter] fff

Just to be sure that everyone understand using dest here is an example it should be a query that I can run that would actually change every multivalue field regardless of field name.

Cheers,

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| foreach *
    [| eval <<FIELD>>=mvjoin(<<FIELD>>,",")]

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| foreach *
    [| eval <<FIELD>>=mvjoin(<<FIELD>>,",")]
0 Karma

wealot
Explorer

Mind blown! I did not know that foreach existed in Splunk, thanks!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...