Splunk Search

How would I add commas to a multi-key value, excluding the last item? OR better way to add a line break?

mcrawford44
Communicator

Hi all,

CSV export of multi-key values is a bit basic at the moment. It exports each value with a space delimiter.

I have a query that returns multi-key values like so;

Item1
Item2
Item3

I've tried using the following to add a linebreak/return and all it does is truncate all but the first item. This is using 'shift-enter' to create the break;

eval <fieldname> = <fieldname>."
"

As an alternative; I use a comma and replace them in excel;

eval <fieldname> = <fieldname>.","

The only issue, is that this adds a comma to the last value in the set as well. Is there any way to avoid that?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could join up your field manually before the export using eval's mvjoin function - that accepts a delimiter that won't be appended to the last item.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...