https://community.splunk.com/t5/Splunk-Search/How-do-you-join-two-fields-with-dedup/m-p/377096#M110647 <P>Hello folks, </P> <P>Trying to figure out how to go about joining 2 fields with a dash but only if they don't have the same values. Ideally, if there's a way to dynamically add the - only if 2 strings, that would cool!</P> <PRE><CODE>string1 string2 string3 string10 string20 string20 string11 string100 string100 index=xyz sourcetype=zzz |table field1 field2 field3 |eval joined = field2 + " - " + field3 |table field1 joined </CODE></PRE> <P>Results desired for joined field</P> <PRE><CODE> string1 string2 - string3 string10 string20 string11 string100 </CODE></PRE> Fri, 08 Feb 2019 15:54:11 GMT splunker1981 2019-02-08T15:54:11Z https://community.splunk.com/t5/Splunk-Search/How-do-you-join-two-fields-with-dedup/m-p/377096#M110647 <P>Hello folks, </P> <P>Trying to figure out how to go about joining 2 fields with a dash but only if they don't have the same values. Ideally, if there's a way to dynamically add the - only if 2 strings, that would cool!</P> <PRE><CODE>string1 string2 string3 string10 string20 string20 string11 string100 string100 index=xyz sourcetype=zzz |table field1 field2 field3 |eval joined = field2 + " - " + field3 |table field1 joined </CODE></PRE> <P>Results desired for joined field</P> <PRE><CODE> string1 string2 - string3 string10 string20 string11 string100 </CODE></PRE> Fri, 08 Feb 2019 15:54:11 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-join-two-fields-with-dedup/m-p/377096#M110647 splunker1981 2019-02-08T15:54:11Z https://community.splunk.com/t5/Splunk-Search/How-do-you-join-two-fields-with-dedup/m-p/377097#M110648 <P>Like this:</P> <PRE><CODE> index=xyz sourcetype=zzz | eval joined=if((field2!=field3), field2 . "-" . field3, null()) </CODE></PRE> Fri, 08 Feb 2019 16:02:04 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-join-two-fields-with-dedup/m-p/377097#M110648 woodcock 2019-02-08T16:02:04Z