<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to combine two field values into one in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-field-values-into-one/m-p/513046#M143940</link>
    <description>&lt;P class="lia-align-justify"&gt;Looks like I got the solution.&amp;nbsp; I have used MATCH&amp;nbsp; to solve it.&lt;/P&gt;&lt;P class="lia-align-justify"&gt;Thank you&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/129407"&gt;@thambisetty&lt;/a&gt;&amp;nbsp;&lt;/P&gt;</description>
    <pubDate>Fri, 07 Aug 2020 16:38:42 GMT</pubDate>
    <dc:creator>skodak</dc:creator>
    <dc:date>2020-08-07T16:38:42Z</dc:date>
    <item>
      <title>How to combine two field values into one</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-field-values-into-one/m-p/513036#M143936</link>
      <description>&lt;P&gt;I have got a query like this&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;index=* request in (request1, request2, request3)&lt;/P&gt;&lt;P&gt;eval&amp;nbsp; request&amp;amp;&amp;amp; = request1 + request2&lt;/P&gt;&lt;P&gt;Please help.&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 07 Aug 2020 15:46:50 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-field-values-into-one/m-p/513036#M143936</guid>
      <dc:creator>skodak</dc:creator>
      <dc:date>2020-08-07T15:46:50Z</dc:date>
    </item>
    <item>
      <title>Re: How to combine two field values into one</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-field-values-into-one/m-p/513039#M143937</link>
      <description>&lt;P&gt;Based on your query I understand that request1,request2,request3 are values of request.&amp;nbsp;&lt;BR /&gt;eval you are adding request1,request2 you will get empty because you don’t have those fields.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;share sample event and explain your question clearly.&lt;/P&gt;</description>
      <pubDate>Fri, 07 Aug 2020 15:51:50 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-field-values-into-one/m-p/513039#M143937</guid>
      <dc:creator>thambisetty</dc:creator>
      <dc:date>2020-08-07T15:51:50Z</dc:date>
    </item>
    <item>
      <title>Re: How to combine two field values into one</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-field-values-into-one/m-p/513046#M143940</link>
      <description>&lt;P class="lia-align-justify"&gt;Looks like I got the solution.&amp;nbsp; I have used MATCH&amp;nbsp; to solve it.&lt;/P&gt;&lt;P class="lia-align-justify"&gt;Thank you&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/129407"&gt;@thambisetty&lt;/a&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 07 Aug 2020 16:38:42 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-field-values-into-one/m-p/513046#M143940</guid>
      <dc:creator>skodak</dc:creator>
      <dc:date>2020-08-07T16:38:42Z</dc:date>
    </item>
    <item>
      <title>Re: How to combine two field values into one</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-field-values-into-one/m-p/513047#M143941</link>
      <description>&lt;P&gt;Accept my answer as solution if you think my answer Solved your problem.&lt;/P&gt;</description>
      <pubDate>Fri, 07 Aug 2020 16:46:42 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-field-values-into-one/m-p/513047#M143941</guid>
      <dc:creator>thambisetty</dc:creator>
      <dc:date>2020-08-07T16:46:42Z</dc:date>
    </item>
  </channel>
</rss>

