Splunk Search

concatenating more than one field

abhayneilam
Contributor

Hi,

I have three fields :

field1 field2 field3
delhi
delhi
kol
delhi mumbai

delhi kol

mumbai kolkata andhra

Output should be like :

Final_Field
delhi
delhi
kol
delhi,mumbai
delhi,kol
mumbai,kolkata,andhra

Please help !!

Thanks

0 Karma

yannK
Splunk Employee
Splunk Employee

use an eval to concatenate the fields, and in the case a field is missing, use a sed command to remove the extra separation commas.

mysearch | fillnull value="" field1 field2 field3 | eval myfield=field1.",".field2.",".field3 | rex field=myfield mode=sed "s/([,]*)}/,/g" | table myfield

remark : sed command not tested, please try or replace by some logic in the eval.

yannK
Splunk Employee
Splunk Employee

Thanks Kristian, the fillnull is required indeed, let me add it.

0 Karma

kristian_kolb
Ultra Champion

Thats what one would like to think, but if either of the fields is missing altogether, the eval fails.

You'd have to use fillnull or similar first.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...