Splunk Search

Values function separator

ERICKWONG
Explorer

My query is the following
index="_internal" | table host | stats values(host)

output:

values(host)

host1

host2




I want the output is the following

output:

values(host)

host1,

host2




Is there any method to do ?

Tags (1)
0 Karma

ERICKWONG
Explorer

Is there any method to add a line break between?
Not only a comma.

output:
host1,
host2,
host3

0 Karma

ERICKWONG
Explorer

index=_internal | stats values(host) as somename | eval somename=mvjoin(somename,",")

It works@@, Thx~

Ayn
Legend

So, you want to have one row of comma-separated values instead of separate ones? If so, you could do

index=_internal | stats values(host) as somename | eval somename=mvjoin(somename,",")

ERICKWONG
Explorer

I want to add a "comma" in my result

host1,host2

Is there any function to do?

0 Karma

ERICKWONG
Explorer

I want to add a "comma" in my result

host1,host2

0 Karma

Ayn
Legend

The first row is a header row so it'd be misleading to put an actual field value there. You can rename the text in the header if you want:

index=_internal | stats values(host) as someothername

(I removed the table command in your search because you don't need it)

Get Updates on the Splunk Community!

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...