Splunk Search

How to use delim with stats?

adityainamdar89
Explorer

How to use delim with stats? Multivalued fields generated after using list() in stats is resulting in space-separated values to be emailed to me in a scheduled search rather than them appearing on a new line. Will delim be helpful? If not, is there any other way?

Tags (3)
0 Karma
1 Solution

adityainamdar89
Explorer

I found this solution to my problem:

| stats delim=":" list(XYZ) as XYZ BY CRITERIA
| rex mode=sed field=XYZ "s/:/\n/g"

This gives you the results on new lines in the table emailed from splunk.

View solution in original post

adityainamdar89
Explorer

Thanks..I figured out the solution 🙂

0 Karma

adityainamdar89
Explorer

I found this solution to my problem:

| stats delim=":" list(XYZ) as XYZ BY CRITERIA
| rex mode=sed field=XYZ "s/:/\n/g"

This gives you the results on new lines in the table emailed from splunk.

ppablo
Retired

Glad you found a solution @adityainamdar89 🙂 Be sure to accept your answer (clicking on the check mark to the left of this answer) so other users with similar issues will look to this post for help. You also get some karma points too!

martin_mueller
SplunkTrust
SplunkTrust

You can for example set delim=";" and your values will be separated by a semicolon... however, I haven't gotten a newline to work.

Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...