Skip to content
SPL // Splunk

Using the mvjoin Command


Written by: Steve Bowser | Last Updated:

January 16, 2024
Splunk Search Command Of The Week: mvjoin

Originally Published:

September 1, 2023

Data that has multiple values in a single field can be difficult to view in a report. Splunk’s Search Processing Language (SPL) offers several functions that can make this data more readable, including the mvjoin command.

What is the Splunk mvjoin Function?

The mvjoin command (remember: mv means “Multi Value”) allows the Splunk user to collate data onto a single line and separate the data by a delimiter. The delimiter can be any character including spaces.

The Benefits of Splunk mvjoin

The figure below shows the output from a “|stats values” command/function. This tends to be a little confusing to interpret. Utilizing mvjoin can make multivalue outputs more readable.

The syntax for mvjoin via “| eval” (for this example)

					| eval <new field name>=mvjoin(fieldname,”delimiter”)


In the figure below, spaces between the values, in the field “Value_Field” are being utilized.

| stats values(Value) AS Values BY host 
| eval Value_Field=mvjoin(Values,” “)


In the next example, a forward slash along with spaces demonstrates another option. Any character, or combination of characters can be used as a delimiter.

| stats values(Value) AS Values BY host 
| eval Value_Field=mvjoin(Values,” / “) 


Presenting data in a highly readable form is a goal that all Splunkers should strive for. Stakeholders appreciate knowledge objects that are concise and interpreted easily. The mvjoin function is a tool that easily accomplishes this.

Helpful? Don't forget to share this post!
Share on linkedin
Share on reddit
Share on email
Share on twitter
Share on facebook