Splunk Search

How to convert to multivalue field?


I'm trying to convert a field with multiple results into a multivalue field.

I'm querying a host lookup table that has several hostnames. I'd like to create a single multivalue field containing all the hostnames returned by the inputlookup command separated by a comma. I'm using the makemv command to do this but it returns each host as a separate result instead of a single result with all the hosts separated by commas. 


Any suggestions?

here's my query:

| inputlookup host_table

fields hostname
| makemv delim="," hostname

| table hostname


Thanks in advance.


Labels (1)
0 Karma


First, please clarify that you want a comma-delimited string as output, not a multivalue field.  Is this correct?  to get a true multivalue field, use

| inputlookup host_table
| stats values(hostname) as hostname

To get one comma-separated text string, do

| inputlookup host_table
| stats values(hostname) as hostname
| eval hostname = mvjoin(hostname, ",")

This latter output will be single-valued.

Tags (2)
0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...