Refine your search:

So I'm trying to run a search in Splunk and have two fields combined to return one larger field. My basic search is:

(host="" AND source="/var/log/apache2/basf_ssl_access.log" AND "/profile-services/talent") OR (host="" AND AND "GET /search" AND query=*)

From that I'm interested in two fields: 1) 'query' 2) 'q'. I would like to combine these two fields to end with something like:

... | stats count by newField

From searching I have tried using eval like this:

... | eval newField= query." ".q | stats count by newField

However I've had absolutely no luck at all with this. Any help with this would be greatly appreciated.

asked 18 May '12, 12:24

henryt1's gravatar image

accept rate: 0%

One Answer:

Your eval statement is fine. You need to fix the stats count. This should do it.

. | eval newField= query." ".q | stats count(newField)

Then you could do | stats count(newField) by newField


answered 18 May '12, 13:34

sdaniels's gravatar image

sdaniels ♦
accept rate: 33%

edited 18 May '12, 13:34

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions



Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported



Asked: 18 May '12, 12:24

Seen: 1,693 times

Last updated: 18 May '12, 13:34

Copyright © 2005-2014 Splunk Inc. All rights reserved.