Splunk Search

How would I add commas to a multi-key value, excluding the last item? OR better way to add a line break?

mcrawford44
Communicator

Hi all,

CSV export of multi-key values is a bit basic at the moment. It exports each value with a space delimiter.

I have a query that returns multi-key values like so;

Item1
Item2
Item3

I've tried using the following to add a linebreak/return and all it does is truncate all but the first item. This is using 'shift-enter' to create the break;

eval <fieldname> = <fieldname>."
"

As an alternative; I use a comma and replace them in excel;

eval <fieldname> = <fieldname>.","

The only issue, is that this adds a comma to the last value in the set as well. Is there any way to avoid that?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could join up your field manually before the export using eval's mvjoin function - that accepts a delimiter that won't be appended to the last item.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...