Splunk Search

How to use delim with stats?

adityainamdar89
Explorer

How to use delim with stats? Multivalued fields generated after using list() in stats is resulting in space-separated values to be emailed to me in a scheduled search rather than them appearing on a new line. Will delim be helpful? If not, is there any other way?

Tags (3)
0 Karma
1 Solution

adityainamdar89
Explorer

I found this solution to my problem:

| stats delim=":" list(XYZ) as XYZ BY CRITERIA
| rex mode=sed field=XYZ "s/:/\n/g"

This gives you the results on new lines in the table emailed from splunk.

View solution in original post

adityainamdar89
Explorer

Thanks..I figured out the solution 🙂

0 Karma

adityainamdar89
Explorer

I found this solution to my problem:

| stats delim=":" list(XYZ) as XYZ BY CRITERIA
| rex mode=sed field=XYZ "s/:/\n/g"

This gives you the results on new lines in the table emailed from splunk.

View solution in original post

ppablo
Community Manager
Community Manager

Glad you found a solution @adityainamdar89 🙂 Be sure to accept your answer (clicking on the check mark to the left of this answer) so other users with similar issues will look to this post for help. You also get some karma points too!

martin_mueller
SplunkTrust
SplunkTrust

You can for example set delim=";" and your values will be separated by a semicolon... however, I haven't gotten a newline to work.

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!