Splunk Search

How to use delim with stats?

adityainamdar89
Explorer

How to use delim with stats? Multivalued fields generated after using list() in stats is resulting in space-separated values to be emailed to me in a scheduled search rather than them appearing on a new line. Will delim be helpful? If not, is there any other way?

Tags (3)
0 Karma
1 Solution

adityainamdar89
Explorer

I found this solution to my problem:

| stats delim=":" list(XYZ) as XYZ BY CRITERIA
| rex mode=sed field=XYZ "s/:/\n/g"

This gives you the results on new lines in the table emailed from splunk.

View solution in original post

adityainamdar89
Explorer

Thanks..I figured out the solution 🙂

0 Karma

adityainamdar89
Explorer

I found this solution to my problem:

| stats delim=":" list(XYZ) as XYZ BY CRITERIA
| rex mode=sed field=XYZ "s/:/\n/g"

This gives you the results on new lines in the table emailed from splunk.

ppablo
Retired

Glad you found a solution @adityainamdar89 🙂 Be sure to accept your answer (clicking on the check mark to the left of this answer) so other users with similar issues will look to this post for help. You also get some karma points too!

martin_mueller
SplunkTrust
SplunkTrust

You can for example set delim=";" and your values will be separated by a semicolon... however, I haven't gotten a newline to work.

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...