Combine a numerical field with a string field separated with a dash

subhrangshu — Wed, 19 Aug 2020 14:38:59 GMT

Hello,

I am trying to combine couple of fields data separated by a dash. Tried few options but could not get the expected output.

My query is:

index=test sourcetype="test-abc" ("enter start()")
| rename job_id as JOB_ID
| stats earliest(_time) AS Earliest by JOB_ID
| eval FirstEvent=strftime(Earliest,"%b %d, %Y %H:%M:%S")
| eval JOB_ID_STR=tostring(JOB_ID)
| eval JOB-ID-WITH-TIME=printf("%s%z", JOB_ID_STR,FirstEvent)

In the above query: JOB_ID is a numerical data of length 4 digit. FirstEvent is string of time format of that event.

Ex:

JOB_ID = 9000 and FirstEvent = Jul 07, 2020 04:56:43

Using the above query and with printf function, JOB-ID-WITH-TIME is returned as 9000Jul 07, 2020 04:56:43.

I want the output to be like 9000-Jul 07, 2020 04:56:43 (a dash between JOB_ID and FirstEvent).

How to do it?

Thanks in advance for your time!

Re: Combine a numerical field with a string field separated with a dash

diogofgm — Wed, 19 Aug 2020 14:43:40 GMT

You can just use eval for that:

JOB_ID = 9000 and FirstEvent = Jul 07, 2020 04:56:43

| eval job_with_time = JOB_ID + "-" + FirstEvent

Re: Combine a numerical field with a string field separated with a dash

subhrangshu — Wed, 19 Aug 2020 15:00:50 GMT

Thanks for the prompt reply. I don't know, how I missed this. Thanks again 😃

topic Combine a numerical field with a string field separated with a dash in Splunk Search

Combine a numerical field with a string field separated with a dash

Re: Combine a numerical field with a string field separated with a dash

Re: Combine a numerical field with a string field separated with a dash