Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

When concatenating a field across rows into a single string, the concatenation stops when it encounters a comma. How can I allow the concatenation to continue past the comma?

$
0
0
This is an add-on to a previous question which was answered correctly: https://answers.splunk.com/answers/318322/how-can-i-concatenate-a-single-fields-value-across.html The above answer works wonderfully except when there is a comma in the payload field. How can I tell the query to just treat the comma like a regular character? For this data: date payload XXXX String 1- XXXX String 2- XXXX String 3 I get the follow which is expected String 1-String 2-String3 But this data: date payload XXXX String 1- XXXX String 2-, XXXX String 3 Results in this truncation at the comma String 1-String 2

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>