Splunk Search

Values function separator

ERICKWONG
Explorer

My query is the following
index="_internal" | table host | stats values(host)

output:

values(host)

host1

host2




I want the output is the following

output:

values(host)

host1,

host2




Is there any method to do ?

Tags (1)
0 Karma

ERICKWONG
Explorer

Is there any method to add a line break between?
Not only a comma.

output:
host1,
host2,
host3

0 Karma

ERICKWONG
Explorer

index=_internal | stats values(host) as somename | eval somename=mvjoin(somename,",")

It works@@, Thx~

Ayn
Legend

So, you want to have one row of comma-separated values instead of separate ones? If so, you could do

index=_internal | stats values(host) as somename | eval somename=mvjoin(somename,",")

ERICKWONG
Explorer

I want to add a "comma" in my result

host1,host2

Is there any function to do?

0 Karma

ERICKWONG
Explorer

I want to add a "comma" in my result

host1,host2

0 Karma

Ayn
Legend

The first row is a header row so it'd be misleading to put an actual field value there. You can rename the text in the header if you want:

index=_internal | stats values(host) as someothername

(I removed the table command in your search because you don't need it)

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...