Splunk Search

Joining two fields together

Michael_Schyma1
Contributor

How do I join two fields together so there is not whitespace in my table. I want to join sfailed and EventCodeDescription so that it will list "Shutdown or reboot"

index="Desktop" (EventCode=513 OR EventCode=3003) OR reboot EventCodeDescription= "sfailed" OR "Shutdown"| rex"Shutdown\s\S+(?\s\S+)" | table _time sfailed host user EventCodeDescription | rename _time AS Time | convert timeformat="%H/%M/%S %d.%m.%Y" ctime(Time) | rename user AS Username | rename host AS "Machine Name" EventCodeDescription AS "Description"

Tags (1)
0 Karma
1 Solution

MHibbin
Influencer

You should probably use eval to create a new field, and then use coalesce to combine these two fields. e.g.

...| eval newField=coalesce(EventCodeDescription,sfailed)|...

View solution in original post

MHibbin
Influencer

You should probably use eval to create a new field, and then use coalesce to combine these two fields. e.g.

...| eval newField=coalesce(EventCodeDescription,sfailed)|...

sowings
Splunk Employee
Splunk Employee

Coalesce is probably not what you want; it picks the first non-null from the list and returns that. Instead, string manipulation will do what you want:


eval newField=EventCodeDescription + sfailed

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...