mvcombine command: Overview, syntax, and usage
The SPL2 mvcombine command takes a group of identical events except for a specified field, combines those events into a single event, and creates a multivalue field with the values from the specified field.
The SPL2 mvcombine command takes a group of events that are identical except for the specified field, which contains a single value, and combines those events into a single event. The specified field becomes a multivalue field that contains all of the single values from the combined events.
The mvcombine command is most useful after you reduce the set of available fields by using the stats, select, or fields command.
Syntax
The required syntax is in bold.
mvcombine
[delim=string]
field
Required parameters
field
Syntax: field
Description: The name of the field to generate the multivalues from.
Optional parameters
delim=string
Description: A string value used as a delimiter.
Default: A single space (" ").
Usage
The SPL2 mvcombine command does not apply to internal fields.
See also
mvcombine command