topic Can I display the variable concatenated in a table? in Splunk Search

Can I display the variable concatenated in a table?

cgaete — Fri, 16 Jun 2017 18:13:12 GMT

Hi, everyone

When I create a field concatenated with eval, example: |eval date = day. "/" .month." /". year. |
Can I display the variable date in a table?.

Note: I use Splunk 6.1.

Thanks

Re: Can I display the variable concatenated in a table?

horsefez — Fri, 16 Jun 2017 18:57:38 GMT

Hi cgaete,

if the fields
- day
- month
- year
are valid fields in your data you can do something like this.

| eval date = day + "/" + month + "/" + year | table date

Re: Can I display the variable concatenated in a table?

woodcock — Fri, 16 Jun 2017 21:53:19 GMT

I don't understand; your question is so elemental that it should have taken you 10 times longer to post this question than it could have taken you to actually try it and see that it works. If you really do have a problem, then post samples events and your search.

Re: Can I display the variable concatenated in a table?

woodcock — Sat, 15 Jul 2017 04:08:22 GMT

I would never use + for concatenation operator because it also the addition operator and the latter has higher precedence making an invisible land mine for somebody (maybe even yourself) later on. I think that the original problem was a lack of spaces around each . operator.