Hi,
I have an output like this -
Location | EventName | ErrorCode | Summary |
server1 | Mssql.LogBackupFailed | BackupAgentError | Failed backup.... |
server2 | Mssql.LogBackupFailed | BackupAgentError | Failed backup.... |
Now I am trying to combine all the values of Location, EventName, ErrorCode and Summary into one field called "newfield" , lets say using a comma "," or ";"
I am trying this command -
| eval newfield= mvappend(LocationName,EventName,ErrorCode,summary)
but the output it is giving is -
server1 |
Mssql.LogBackupFailed |
BackupAgentError |
Failed backup.... |
Output I am expecting is -
server1,Mssql.LogBackupFailed,BackupAgentError,Failed backup |
| eval newfield= mvjoin(mvappend(LocationName,EventName,ErrorCode,summary),",")
Hi @man03359 ,
if you want the values of the fields separated by comma, you should use eval in this way:
| eval newfield=LocationName.",".EventName.",".ErrorCode.",".summary
Ciao.
Giuseppe