Combine Multiple Fields

JaysonD123 — Thu, 04 Feb 2021 18:15:40 GMT

Hello,

I'm relatively new to Splunk. I have multiple fields with different naming schemes that have different or identical values. Here's an example:

hash=yj843yj387hfhjf723hjf47hnf29nf

hashes=xmv98svmd89djmfv98jvkfj9jm

Hashes=n9nuevur9vv9v8fj0fefjeffjv9ejve8

sha1_hash=84hmrh42mfu2hmxufxfmu28

src_hash=2xf9mf4jmfijjumrfx2r9mjfru2mjrm9j

name=jayson

Src_name=jayson

NAME=jayson

SubjectUserName=jayson

I'm trying to make a query checks if there is a field that contains the word "hash" or "name" and tables it out. Here's what I have so far:

| eval Hash=hash, Hash=hashes

| foreach Hash* [eval Hash=mvappend(Hash, "")]
| eval Name=name, Name=Src_name
| foreach Name* [eval Name=mvappend(Name, "")
| table Name Hash

I need to table the results from any field that has the word "hash" or "name" in it. Also is there a way to simplify this?

Re: Combine Multiple Fields

bowesmana — Thu, 04 Feb 2021 21:11:31 GMT

@JaysonD123

Good to see that you're diving in the deep end with the use of foreach, which is not such a commonly used command, but a very powerful one...

You're on the right track, but your initial assignments Hash=hash, Hash=hashes, will not do much good as it's making the field Hash equal to the field hashes, regardless of what hash is.

Fields are case sensitive, so from your sample data, you need to be doing a case insensitive comparison of the field name to either name or hashes. This runnable example shows you how to do this, also using foreach, but using the <<MATCHSTR>> and <<FIELD>> elements of foreach, which are crucial to getting this to work.

| makeresults | eval hash="yj843yj387hfhjf723hjf47hnf29nf" | eval hashes="xmv98svmd89djmfv98jvkfj9jm" | eval Hashes="n9nuevur9vv9v8fj0fefjeffjv9ejve8" | eval sha1_hash="84hmrh42mfu2hmxufxfmu28" | eval src_hash="2xf9mf4jmfijjumrfx2r9mjfru2mjrm9j" | eval name="jayson" | eval Src_name="jayson" | eval NAME="jayson" | eval SubjectUserName="jayson" | eval anotherField1="Something else", anotherField2="another" | foreach * [ eval N=if(match("<<MATCHSTR>>","(?i)name"), mvappend("<<MATCHSTR>>=".<<FIELD>>, N), N), H=if(match("<<MATCHSTR>>","(?i)hash"), mvappend("<<MATCHSTR>>=".<<FIELD>>, H), H)]

All you need is the foreach statement. I have made it foreach *, so all field names can be checked. The H and N fields end up with a multi value field with fieldName=value for each of the matching fields.

Edit the mvappend as required.

topic Combine Multiple Fields in Splunk Search

Combine Multiple Fields

Re: Combine Multiple Fields