Multivalue
The following list contains the functions that you can use on multivalue fields or to return multivalue fields.
mvappend(X,...)
Takes an arbitrary list of arguments, where each argument is a single string or a list of strings, and returns all elements as a single flattened list.
- Function Input
- collection<any>
- Function Output
- string
DSL example
Returns [\"lorem\",\"lorem\",\"ipsum\",\"dolor\",\"sit\",\"amet\",\"consectetuer\"]
in field "newlist".
as(mvappend("lorem", "lorem", list("ipsum", "dolor"), list("sit", "amet"), "consectetuer"), "newlist");
Mathematical | String manipulation |
This documentation applies to the following versions of Splunk® Data Stream Processor: 1.0.1
Feedback submitted, thanks!