generate a comma delimited list

royimad · ‎07-30-2013

I have the following search
sourcetype = "DevicesInfo" | stats values(DeviceSubType) as series | makemv delim="," series | fields series
but the result string "series" is not comma seperated.
Does anyone have an idea why the result i'm getting is not comma seperated?
Thanks!

Ayn · ‎07-30-2013

You should read the docs.

makemv is used for creating a multivalued field out of a comma-separated string, not the other way around. To do the opposite, use eval's function mvjoin.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Makemv
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

generate a comma delimited list

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Join the Conversation

generate a comma delimited list

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future