Splunk Enterprise SPL search combine multiple field values into 1 field

user_1801025 0
Viewed 50

I have the following log line:

{"date_time":"20220902-12:20:20.628640865","severity":"INFO","origin":"CME","pipeline":"cme_channel_310","mdflow_core_version":"1.1.0","mdflow_msgapi_version":"2.2.0","mdflow_apps_version":"3.3.0","alias_name":"PROD","num_instruments":"10000"}

I want to display (in table format) the origin and versions like so:

Origin   Versions
CME      1.1.0/2.2.0/3.3.0

I am "close" with using strcat and creating the versionCombo field. Here is my full query...

| spath 
| strcat mdflow_core_version "/" mdflow_msgapi_version "/" mdflow_apps_version versionCombo
| stats values(origin) as Origin values(versionCombo) as Versions

The above search results in this with multiple lines of somewhat concatenated strings...

Origin   Versions
CME      //
         1.1.0
         1.1.0/2.2.0
         2.2.0/3.3.0
         3.3.0

I need it be all on one line with the value: "1.1.0/2.2.0/3.3.0". Any help here would be appreciated. Thank you in advance!

splunk-query splunk
2 Answers

What version of Splunk are you using? Is there anything about the data or the query you haven't shared? The query works fine on both of my sandbox systems.

enter image description here

user_22274200

Interestingly, if I remove the | spath, it works.

user_18010250
Related