I'm trying to convert a field with multiple results into a multivalue field.
I'm querying a host lookup table that has several hostnames. I'd like to create a single multivalue field containing all the hostnames returned by the inputlookup command separated by a comma. I'm using the makemv command to do this but it returns each host as a separate result instead of a single result with all the hosts separated by commas.
Any suggestions?
here's my query:
| inputlookup host_table
fields hostname
| makemv delim="," hostname
| table hostname
Thanks in advance.
First, please clarify that you want a comma-delimited string as output, not a multivalue field. Is this correct? to get a true multivalue field, use
| inputlookup host_table
| stats values(hostname) as hostname
To get one comma-separated text string, do
| inputlookup host_table
| stats values(hostname) as hostname
| eval hostname = mvjoin(hostname, ",")
This latter output will be single-valued.