Splunk Search

How to display two field values in a single table column?

JohnSwansson
Explorer

I have the following search:

index=cashflow host=atm source=income OR source=outcome | eval accountStatus="Income: " + transactionIncome + " and Outcome: " + transactionOutcome | table accountStatus

I have validated that | table transactionIncome transactionOutcome works, meaning that I see the values of each field in separate columns, but it does not work combining them in a single column called accountStatus as the query would. Why is this? I am also not able to do a column with the sum of [ transactionIncome + transactionOutcome ]. What have I not understood?

EDIT: Okay so apparently you can't add the value of a field from one event with the value of a field in another event. How would one go about this? transactionIncome and transactionOutcome are generated from different sources and are not within the same event.

somesoni2
SplunkTrust
SplunkTrust

If you query gives you only two events, one with transactionIncome and other with transactionOutcome, then try something like this

index=cashflow host=atm source=income OR source=outcome | stats values(transactionIncome) as transactionIncome values(transactionOutcome) as transactionOutcome by host | eval accountStatus="Income: " + transactionIncome + " and Outcome: " + transactionOutcome | table accountStatus

Update
Try this

 index=cashflow host=atm source=income OR source=outcome | eval transactionIncome=coalesce(transactionIncome,null()) | eval transactionOutcome=coalesce(transactionOutcome,null())| stats values(transactionIncome) as transactionIncome values(transactionOutcome) as transactionOutcome by host | eval accountStatus="Income: " + transactionIncome + " and Outcome: " + transactionOutcome | table accountStatus
0 Karma

JohnSwansson
Explorer

Sorry, no, same result as before. It works only with transactionIncome or transactionOutcome, never both at the same time...

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Do you have any common field/value that can be used to combine two events?? OR if they always appear in a particular order which can be used?

0 Karma

JohnSwansson
Explorer

They both share the same host!

0 Karma

pradeepkumarg
Influencer

Concatenation operator between two strings in splunk is . and not +

 index=cashflow host=atm source=income OR source=outcome | eval accountStatus="Income: ".transactionIncome." and Outcome: ".transactionOutcome | table accountStatus
0 Karma

JohnSwansson
Explorer

Still doesn't work, when running eval accountStatus="Income: ".transactionIncome." and Outcome: ".transactionOutcome i get:

Nothing. accountStatus is empty.

When running: eval accountStatus="Income: ".transactionIncome I get:

Income: 100

When running eval accountStatus=" and Outcome: ".transactionOutcome I get:

and Outcome: 200

... but within the same row and within the same "string of text" it will not show up.

0 Karma

krishnarajapant
Path Finder

Hi,

You can add the columns using "addcoltotals" and "addtotals" commands.

Also I tried with below and it is working fine for me. In my example code and bytes are two different fields.

sourcetype=* | eval x= code + bytes | table code bytes x | fieldformat x= "Total:".x

-Krishna Rajapantula

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...