topic Re: Create a variable that combines two string values in Splunk Search

Create a variable that combines two string values

viggor — Fri, 11 Aug 2017 15:38:27 GMT

I have a simple question:

I have two variables foo and bar, each containing a set of strings, and I would like to create a new variable foobar which contains the union of foo and bar.

I am aware of the | set union command, but I don't seem to get it to work for this scenario.

Re: Create a variable that combines two string values

richgalloway — Fri, 11 Aug 2017 16:52:10 GMT

What do you mean by "union"? Can you give an example of your fields and desired output?

Have you looked at the mvzip function?

Re: Create a variable that combines two string values

Sarmbrister — Fri, 11 Aug 2017 16:55:37 GMT

Would an eval expression work in this case?

Example

search... | eval new_variable=foo. "" .bar

Re: Create a variable that combines two string values

somesoni2 — Mon, 14 Aug 2017 18:44:32 GMT

I believe you need to use mvappend command with mvdedup (to remove duplicates) with eval. If they're not multivalued fields, you have to convert them to mv first. We can suggest more accurate options if you can provide some sample values.