Splunk Search

How would I add commas to a multi-key value, excluding the last item? OR better way to add a line break?

mcrawford44
Communicator

Hi all,

CSV export of multi-key values is a bit basic at the moment. It exports each value with a space delimiter.

I have a query that returns multi-key values like so;

Item1
Item2
Item3

I've tried using the following to add a linebreak/return and all it does is truncate all but the first item. This is using 'shift-enter' to create the break;

eval <fieldname> = <fieldname>."
"

As an alternative; I use a comma and replace them in excel;

eval <fieldname> = <fieldname>.","

The only issue, is that this adds a comma to the last value in the set as well. Is there any way to avoid that?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could join up your field manually before the export using eval's mvjoin function - that accepts a delimiter that won't be appended to the last item.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...