https://community.splunk.com/t5/Splunk-Enterprise-Security/Combining-two-fields-with-a-constant-string-between/m-p/482740#M7816 <P>I am pulling two fields from a CSV based off of a field in live logs, then combining them into one field with a constant string in between them.<BR /> What I have tried thus far :</P> <P>|eval field3=field1." - ".field2<BR /> |eval field3=field1 + " - " + field2<BR /> |eval field3=if(field1="<EM>", field1." - ".field2, "didnt work")<BR /> |eval field3=if(field1="</EM>", field1 + " - " + field2, "didnt work")<BR /> |eval field3=if(NOT (field1=""), field1." - ".field2, "didnt work")<BR /> |eval field3=if( NOT (field1=""), field1 + " - " + field2, "didnt work")</P> <P>None of these work. Even with a fillnull before them.</P> Tue, 25 Feb 2020 16:55:04 GMT Braagi 2020-02-25T16:55:04Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Combining-two-fields-with-a-constant-string-between/m-p/482740#M7816 <P>I am pulling two fields from a CSV based off of a field in live logs, then combining them into one field with a constant string in between them.<BR /> What I have tried thus far :</P> <P>|eval field3=field1." - ".field2<BR /> |eval field3=field1 + " - " + field2<BR /> |eval field3=if(field1="<EM>", field1." - ".field2, "didnt work")<BR /> |eval field3=if(field1="</EM>", field1 + " - " + field2, "didnt work")<BR /> |eval field3=if(NOT (field1=""), field1." - ".field2, "didnt work")<BR /> |eval field3=if( NOT (field1=""), field1 + " - " + field2, "didnt work")</P> <P>None of these work. Even with a fillnull before them.</P> Tue, 25 Feb 2020 16:55:04 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Combining-two-fields-with-a-constant-string-between/m-p/482740#M7816 Braagi 2020-02-25T16:55:04Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Combining-two-fields-with-a-constant-string-between/m-p/482741#M7817 <P>Hi</P> <P>Try field1 and field2 with a single quote</P> <PRE><CODE>| makeresults | eval field1="test",field2="test2" | eval field3='field1'."-".'field2' </CODE></PRE> Tue, 25 Feb 2020 17:24:20 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Combining-two-fields-with-a-constant-string-between/m-p/482741#M7817 vnravikumar 2020-02-25T17:24:20Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Combining-two-fields-with-a-constant-string-between/m-p/482742#M7818 <P>Even though it was basically the first option that was attempted, I tried it with the single-quotes...<BR /> ...to no avail.</P> Tue, 25 Feb 2020 18:11:50 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Combining-two-fields-with-a-constant-string-between/m-p/482742#M7818 Braagi 2020-02-25T18:11:50Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Combining-two-fields-with-a-constant-string-between/m-p/482743#M7819 <PRE><CODE>|eval field3=mvappend(field1,field2) |eval field3=mvjoin(field3,"-") </CODE></PRE> <P>maybe, some fields has null.</P> Tue, 25 Feb 2020 21:04:48 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Combining-two-fields-with-a-constant-string-between/m-p/482743#M7819 to4kawa 2020-02-25T21:04:48Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Combining-two-fields-with-a-constant-string-between/m-p/482744#M7820 <P>This one had some rather unexpected results. "field1" repeated a random number of times, followed by the same number of "field2". The "-" seems to be at the front of every entry but the first.</P> <P>A bit closer, things are showing up but still not quite -&gt; "data - data"</P> Tue, 25 Feb 2020 22:02:05 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Combining-two-fields-with-a-constant-string-between/m-p/482744#M7820 Braagi 2020-02-25T22:02:05Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Combining-two-fields-with-a-constant-string-between/m-p/482745#M7821 <P>the fields are multivalue.<BR /> First, you should convert them to single values</P> Tue, 25 Feb 2020 22:13:47 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Combining-two-fields-with-a-constant-string-between/m-p/482745#M7821 to4kawa 2020-02-25T22:13:47Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Combining-two-fields-with-a-constant-string-between/m-p/482746#M7822 <P>Can you please provide some samples of field1 and field2?</P> Wed, 26 Feb 2020 03:34:19 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Combining-two-fields-with-a-constant-string-between/m-p/482746#M7822 vnravikumar 2020-02-26T03:34:19Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Combining-two-fields-with-a-constant-string-between/m-p/482747#M7823 <P>I think what the underlying issue is that its coming from a CSV. I can get them to display individually, but when I try to combine them in the query... its a no-go.</P> Thu, 27 Feb 2020 15:05:36 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Combining-two-fields-with-a-constant-string-between/m-p/482747#M7823 Braagi 2020-02-27T15:05:36Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Combining-two-fields-with-a-constant-string-between/m-p/482748#M7824 <P>I faced this issue in recent past</P> <P>To appraise if you are using above SPL with datamodel , I would suggest you use <CODE>drop_dm_object_name("datamodel_name")</CODE> before using <CODE>eval</CODE> condition </P> <P>Example</P> <PRE><CODE>| `drop_dm_object_name("datamodel_name")` | eval field3= field1 + ";" + field2 | makemv delim=";" field3 </CODE></PRE> <P>Reference: <A href="https://answers.splunk.com/answers/49394/merge-two-fields-into-one-field.html">https://answers.splunk.com/answers/49394/merge-two-fields-into-one-field.html</A> </P> Thu, 27 Feb 2020 17:00:22 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Combining-two-fields-with-a-constant-string-between/m-p/482748#M7824 sumanssah 2020-02-27T17:00:22Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Combining-two-fields-with-a-constant-string-between/m-p/482749#M7825 <P>There no datamodel, straight index and sourcetype.</P> Thu, 27 Feb 2020 20:17:34 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Combining-two-fields-with-a-constant-string-between/m-p/482749#M7825 Braagi 2020-02-27T20:17:34Z