Splunk Search

Values function separator

ERICKWONG
Explorer

My query is the following
index="_internal" | table host | stats values(host)

output:

values(host)

host1

host2




I want the output is the following

output:

values(host)

host1,

host2




Is there any method to do ?

Tags (1)
0 Karma

ERICKWONG
Explorer

Is there any method to add a line break between?
Not only a comma.

output:
host1,
host2,
host3

0 Karma

ERICKWONG
Explorer

index=_internal | stats values(host) as somename | eval somename=mvjoin(somename,",")

It works@@, Thx~

Ayn
Legend

So, you want to have one row of comma-separated values instead of separate ones? If so, you could do

index=_internal | stats values(host) as somename | eval somename=mvjoin(somename,",")

ERICKWONG
Explorer

I want to add a "comma" in my result

host1,host2

Is there any function to do?

0 Karma

ERICKWONG
Explorer

I want to add a "comma" in my result

host1,host2

0 Karma

Ayn
Legend

The first row is a header row so it'd be misleading to put an actual field value there. You can rename the text in the header if you want:

index=_internal | stats values(host) as someothername

(I removed the table command in your search because you don't need it)

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...