topic concatenate syntax in Splunk Cloud Platform

concatenate syntax

verifi81 — Thu, 29 Apr 2021 05:44:20 GMT

Hi folks

I'm providing a sample of many values I have for field: username

Field: username

Value:

Roger Smith
Bob Dole
Randy Savage

I'm trying to create another field with the EVAL command called EMAIL and placing a dot between first name and last name followed by @Anonymous.com

Basically I'm trying to get the new field like this.

Field: Email

What would the syntax be?

Thanks in advance

kamlesh_vaghela — Thu, 29 Apr 2021 05:52:31 GMT

You should try something like this.

YOUR_SEARCH | eval email= replace(username," ",".")."@falcon.com" | table username email

Sample search.

verifi81 — Thu, 29 Apr 2021 17:02:41 GMT

Hello Kamlesh,

My list of username is 1000 entries long so I won't be able to specify it like that.

verifi81 — Thu, 29 Apr 2021 17:04:56 GMT

I stand corrected. It worked. Thank you!