HI, I have a multivalued field with values as A B C I want it to be replaced as 'A','B','C' . I tried to do it with eval mvjoin, but the first and last values misses the quote like this A','B',...
See more...
HI, I have a multivalued field with values as A B C I want it to be replaced as 'A','B','C' . I tried to do it with eval mvjoin, but the first and last values misses the quote like this A','B','C SPL used is: index=* sourcetype=* host=abc NAME IN ("*A*","*B*","*C*") |stats values(NAME) as NAME by host
| eval NAME = mvjoin(NAME,"','") Any help would be appreciated, thankyou