Hi ,
Can we replace space in multi-value filed with comma ..?
Ex :
field : host
current Values : server1 server2 server3
Required Values : server1,server2,server3
Thanks ...
Hi jonuwz,
i have field input_source_file and I need to make it a comma separated field, i followed your instruction but not able to get the result.
data in input_source_file is : aaaa bbbb
desired: aaaa,bbbb
My query is:
sourcetype="mslogs" ("MPSVCCMN_10081" OR "DBG_21430") earliest="12/5/2012:16:08:00" latest="12/5/2013:16:16:00" | rex field=_raw "Mapping service is running [(?
sample event:
2012-12-05 20:19:17 INFO: [MPSVCCMN_10081] Mapping service is running [xxxx] deployed in [yyyy]
2012-12-05 20:19:17 INFO: READER_1_1_1, DBG_21430, Reading data from input source file [aaaa]
2012-12-05 20:19:17 INFO: READER_1_2_1, DBG_21430, Reading data from input source file [bbbb]
Yep :
... | rex mode=sed field=host "s/ /,/g" | ...