nomv
This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6 , 4.0.7 , 4.0.8 , 4.0.9 , 4.0.10
Contents
nomv
Synopsis
Changes a specified multi-value field into a single-value field at search time.
Syntax
nomv field
Description
Converts values of the specified multi-valued field into one single value (overrides multi-value field configurations set in fields.conf).
Examples
Example 1: For sendmail events, combine the values of the senders field into a single value; then, display the top 10 values.
eventtype="sendmail" | nomv senders | top senders