Splunk Search

How would I add commas to a multi-key value, excluding the last item? OR better way to add a line break?

mcrawford44
Communicator

Hi all,

CSV export of multi-key values is a bit basic at the moment. It exports each value with a space delimiter.

I have a query that returns multi-key values like so;

Item1
Item2
Item3

I've tried using the following to add a linebreak/return and all it does is truncate all but the first item. This is using 'shift-enter' to create the break;

eval <fieldname> = <fieldname>."
"

As an alternative; I use a comma and replace them in excel;

eval <fieldname> = <fieldname>.","

The only issue, is that this adds a comma to the last value in the set as well. Is there any way to avoid that?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could join up your field manually before the export using eval's mvjoin function - that accepts a delimiter that won't be appended to the last item.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...