Creating a multivalue dellimited field from the values in a field

The following example creates a multivalue field from the values in the host field by using the comma as a delimiter:

... | mvcombine delim="," host

Using the mvcombine and nomv commands to convert a delimited string into a single value string

The following example returns a flat string of results with the delimiters, convert the field into single value string by adding the nomv command function to your search:

... | mvcombine delim="," host | nomv host

Returning a multivalue field from results that were summarized with the stats command

The following example uses the stats command to summarize the data and the mvcombine command to return a multivalue field for the host values.

... | stats max(bytes) AS max, min(bytes) AS min BY host | mvcombine host

See also