- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Values function separator
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Values function separator
My query is the following
index="_internal" | table host | stats values(host)
output:
values(host)
host1
host2
I want the output is the following
output:
values(host)
host1,
host2
Is there any method to do ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there any method to add a line break between?
Not only a comma.
output:
host1,
host2,
host3
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
index=_internal | stats values(host) as somename | eval somename=mvjoin(somename,",")
It works@@, Thx~
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So, you want to have one row of comma-separated values instead of separate ones? If so, you could do
index=_internal | stats values(host) as somename | eval somename=mvjoin(somename,",")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I want to add a "comma" in my result
host1,host2
Is there any function to do?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I want to add a "comma" in my result
host1,host2
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The first row is a header row so it'd be misleading to put an actual field value there. You can rename the text in the header if you want:
index=_internal | stats values(host) as someothername
(I removed the table command in your search because you don't need it)
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
