Splunk Search

How would I add commas to a multi-key value, excluding the last item? OR better way to add a line break?


Hi all,

CSV export of multi-key values is a bit basic at the moment. It exports each value with a space delimiter.

I have a query that returns multi-key values like so;


I've tried using the following to add a linebreak/return and all it does is truncate all but the first item. This is using 'shift-enter' to create the break;

eval <fieldname> = <fieldname>."

As an alternative; I use a comma and replace them in excel;

eval <fieldname> = <fieldname>.","

The only issue, is that this adds a comma to the last value in the set as well. Is there any way to avoid that?

0 Karma


You could join up your field manually before the export using eval's mvjoin function - that accepts a delimiter that won't be appended to the last item.

0 Karma