Splunk® Enterprise

Search Reference

Download manual as PDF

Splunk version 4.x reached its End of Life on October 1, 2013. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

nomv

Description

Converts values of the specified multivalue field into one single value. Overrides the configurations for the multivalue field that are set in the fields.conf file.

Syntax

nomv <field>

Required arguments

field
Syntax: <field>
Description: The name of a multivalue field.

Usage

There are evaluation functions that you can use on multivalue fields or to return multivalue fields.

Examples

Example 1:

For sendmail events, combine the values of the senders field into a single value. Display the top 10 values.

eventtype="sendmail" | nomv senders | top senders

See also

makemv, mvcombine, mvexpand, convert

Answers

Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the nomv command.

PREVIOUS
mvexpand
  NEXT
outlier

This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18


Comments

Woodcock
mvjoin is not a command, it is an eval function. I have added links in the Usage section to both the eval and stats multivalue functions.

Lstewart splunk, Splunker
March 21, 2017

Also of note: There is no content at this URL and there *definitely* should be:

https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Mvjoin

Woodcock
March 17, 2017

This command is very similar to `mvjoin` and this should be mentioned. Also `mvjoin` should be in the `See also` section.

Woodcock
March 17, 2017

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters