How can I concatenate a single field's value across multiple rows into a single string?

[jeskandarian]

Search:

index=exp eventName="business:SelfServ-ChangeTrip" ChangeBookingEventType=ChangeBookingPayloadChunk hotelChangePayloadId="24c51841-8188-448b-9f4a-26f978ae4af9" 
| sort chunkSequence 
| fields payload

Results:

date       payload
XXXX       String 1-
XXXX       String 2-

I'd like the result to be:

date       payload
XXXX       String 1-String 2-

Obviously I don't care about the date, but I can't seem to get rid of it with fields -_* without messing up the entire search.

[somesoni2 · Accepted solution]

Do something like this

 index=exp eventName="business:SelfServ-ChangeTrip" ChangeBookingEventType=ChangeBookingPayloadChunk hotelChangePayloadId="24c51841-8188-448b-9f4a-26f978ae4af9" 
 | sort chunkSequence | stats list(payload) as payload | nomv payload

[jeskandarian]

This worked great except when the payload field contains a comma. When it runs into a comma the resulting string gets truncated. I imagine I can do something to "list(payload)" but not sure.

[woodcock]

Works for me:

|noop|stats count as field|eval field="a,b,c,d,e" | makemv delim="," field | rex field=field mode=sed "s/c/c,/" | nomv field