Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Search
Splunk Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Search
Search the Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
294 results
Sorted by:
12-27-2020
05:34 PM
Could someone please show the difference between nomv and mvcombine with some examples? What I have seen is that both work exactly the same way and delim parameter in mvcombine doesn't work as e...
05-26-2019
09:16 PM
...uery,
index="default" | stats list(status) as status delim=" - " by task | nomv status
02-06-2013
04:08 PM
I have a multi-valued field that I'm trying to collapse down to a single value but the nomv command adds a whitespace character between the individual values of the field. This is a Base64 encoded s...
05-21-2013
04:05 AM
1 Karma
...ll the subelements as multivalue.
With nomv, I'm able to convert mvfields into singlevalue, but the content contains all the values...
What I want, is having only the first value from the mvfields....
03-27-2012
12:17 PM
1 Karma
I have an mvfield like contract="C53124 C53124 C67943" and I want to end up with unique values like contract="C53124 C67943".
The field is the result of a lookup table matching multiple contracts...
03-09-2016
10:14 AM
...2016-03-09 01:47:59 id=1234 event=2
2016-03-09 01:47:60 id=1234 event=5
| mvcombine delim=" " event
| nomv event
Output
1 1 1 1 1 3 3 3 1 3 4 5 2 2 1 1 1 1 2 5
I need the time t...
10-18-2017
02:12 AM
Hi everyone!
I would like to format a result into a string and I don't even know where to start and if there even is a function for that ...
My results are a simple list of number/characters:
...
05-17-2017
09:07 AM
1 Karma
Is it possible to combine multiple rows into one row ?
COLUMN
frow1
frow2
frow3
to something like
COLUMN
frow1,frow2,frow3
Mvcombine combined all the rows to one row but they are ...
09-20-2019
09:48 AM
I'm trying to add the hostnames that result from a search to the email subject of an alert but currently I'm only able to have 1 hostname in the subject when I use $result.host$. For example if the s...
Labels
- Labels:
-
other
Show results in replies (3)
-
In your search, add this SPL: | evenstats values(host) AS _host_list | nomv _host_list T...
-
...uery index=app_index earliest=-5m | dedup source | eventstats values(host) as hostlists | nomv h...
-
...ource, host I said this: In your search, add this SPL: | evenstats values(host) AS _host_list | nomv...
