This is an add-on to a previous question which was answered correctly: https://answers.splunk.com/answers/318322/how-can-i-concatenate-a-single-fields-value-across.html
The above answer works wonderfully except when there is a comma in the payload field. How can I tell the query to just treat the comma like a regular character?
For this data:
date payload
XXXX String 1-
XXXX String 2-
XXXX String 3
I get the follow which is expected
String 1-String 2-String3
But this data:
date payload
XXXX String 1-
XXXX String 2-,
XXXX String 3
Results in this truncation at the comma
String 1-String 2
↧