Splunk Search

Values function separator

ERICKWONG
Explorer

My query is the following
index="_internal" | table host | stats values(host)

output:

values(host)

host1

host2




I want the output is the following

output:

values(host)

host1,

host2




Is there any method to do ?

Tags (1)
0 Karma

ERICKWONG
Explorer

Is there any method to add a line break between?
Not only a comma.

output:
host1,
host2,
host3

0 Karma

ERICKWONG
Explorer

index=_internal | stats values(host) as somename | eval somename=mvjoin(somename,",")

It works@@, Thx~

Ayn
Legend

So, you want to have one row of comma-separated values instead of separate ones? If so, you could do

index=_internal | stats values(host) as somename | eval somename=mvjoin(somename,",")

ERICKWONG
Explorer

I want to add a "comma" in my result

host1,host2

Is there any function to do?

0 Karma

ERICKWONG
Explorer

I want to add a "comma" in my result

host1,host2

0 Karma

Ayn
Legend

The first row is a header row so it'd be misleading to put an actual field value there. You can rename the text in the header if you want:

index=_internal | stats values(host) as someothername

(I removed the table command in your search because you don't need it)

Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...

Application management with Targeted Application Install for Victoria Experience

Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...