Splunk Search

Help with concatenation needed

damucka
Builder

Hello,

I need to concatenate two variables including strings (e-mail lists) into one.
the code I use for that is the following:

index=mlbso_changelog  sourcetype="*_crashdumps" crash_context OR crash_stack OR crash_shortinfo NOT "table of contents"| reverse
| rex field=source "\/.+_(?P<DBSID>.+)\/(?P<service>.+)\_(?<filenameend>.+)$" 
| eval filename = service."_".filenameend 
| eval PRIO = "P1"
| lookup email_groups.csv DBSID OUTPUT email_recipients_DBSID AS email_recipients_DBSID
| lookup email_groups_critical_alerts.csv "PRIO" OUTPUT email_recipients_critical_alerts AS email_recipients_critical_alerts
| eval email_recipients=email_recipients_critical_alerts+";"+email_recipients_DBSID

So, it all seems to be quite straightforward. However when one of the components is empty (email_recipients_critical_alerts or email_recipients_DBSID) then also the result - email_recipients does not get set. Actually I would expect from the concatenation to set it at least to the other component.
Could you please advise?

Kind Regards,
Kamil

Tags (1)
0 Karma
1 Solution

damucka
Builder

found an answer in another question:

| strcat email_recipients_critical_alerts ";" email_recipients_DBSID email_recipients

Regards,
Kamil

View solution in original post

0 Karma

damucka
Builder

found an answer in another question:

| strcat email_recipients_critical_alerts ";" email_recipients_DBSID email_recipients

Regards,
Kamil

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...