Splunk Search

splunk merge field values

viku7474
Explorer

I have a field called environment which has values like dev,prod,uat,sit.
Now I want to create a new_field which all the field values of environment field.

Example: (4 field values)
environment 
dev
prod
uat
sit

After query: ( 1 field value, separated by any string)
merge_environment= dev | prod | uat | sit

How to achieve this?

Labels (6)
Tags (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Space separated

| stats values(environment) as merge_environment
| nomv merge_environment

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Space separated

| stats values(environment) as merge_environment
| nomv merge_environment
0 Karma

viku7474
Explorer

@ITWhisperer  Thank you!!

It works, Since I am passing this token in mail subject, can I separate it by comma or hyphen.?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Instead of using nomv, try this

| eval merged_environment=mvjoin(merged_environment, ",")
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...