topic Re: How to combine multiple field values to create single field name in eval statement. in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-field-values-to-create-single-field-name/m-p/498366#M138850 <P>@jurjenterpstra </P> <P>Can you please share some sample data and expected results?</P> Mon, 07 Oct 2019 12:12:16 GMT kamlesh_vaghela 2019-10-07T12:12:16Z How to combine multiple field values to create single field name in eval statement. https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-field-values-to-create-single-field-name/m-p/498364#M138848 <P>Hi,</P> <P>I'm trying to combine the values of multiple fields to together form a single field name in an eval if statement.<BR /> Something like the example below.</P> <P>Is that in any way possible? </P> <P>Thanks for your help!</P> <PRE><CODE>| eval {operation}_{merchant}_{country}=if((operation=operation AND country=country AND merchant=merchant), {operation}_{merchant}_{country}+1, 0) </CODE></PRE> Sun, 06 Oct 2019 14:07:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-field-values-to-create-single-field-name/m-p/498364#M138848 jurjenterpstra 2019-10-06T14:07:15Z Re: How to combine multiple field values to create single field name in eval statement. https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-field-values-to-create-single-field-name/m-p/498365#M138849 <P>@jurjenterpstra In order for community to assist you better you should provide more context with your data. For example what are some of the sample data and what is the output you need.</P> Sun, 06 Oct 2019 15:41:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-field-values-to-create-single-field-name/m-p/498365#M138849 niketn 2019-10-06T15:41:52Z Re: How to combine multiple field values to create single field name in eval statement. https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-field-values-to-create-single-field-name/m-p/498366#M138850 <P>@jurjenterpstra </P> <P>Can you please share some sample data and expected results?</P> Mon, 07 Oct 2019 12:12:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-field-values-to-create-single-field-name/m-p/498366#M138850 kamlesh_vaghela 2019-10-07T12:12:16Z Re: How to combine multiple field values to create single field name in eval statement. https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-field-values-to-create-single-field-name/m-p/498367#M138851 <PRE><CODE>| makeresults | eval _raw="operation merchant country 1 2 3 4 5 6 7 8 9 10 11 12" | multikv | table operation merchant country | eval true_condition=$country$+1 | eval {operation}_{merchant}_{country}=if(1==0,$operation$."_".$merchant$."_".$true_conditon$,0) </CODE></PRE> <P>This is a sample search.<BR /> Change the <CODE>if</CODE> search condition to suit your needs.</P> Mon, 07 Oct 2019 13:28:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-field-values-to-create-single-field-name/m-p/498367#M138851 to4kawa 2019-10-07T13:28:56Z