https://community.splunk.com/t5/Splunk-Search/combining-the-results-into-one-field/m-p/88557#M182187 <P>I figured it out.. </P> <PRE><CODE>direction="external" sourcetype="sidewinder" action=blocked src_geo="US" OR src_geo="CA" | eval src_ip_and_src_geo=src_ip." - ".src_geo | top src_ip_and_src_geo showperc=f </CODE></PRE> Fri, 07 Oct 2011 20:34:49 GMT mcbradford 2011-10-07T20:34:49Z https://community.splunk.com/t5/Splunk-Search/combining-the-results-into-one-field/m-p/88554#M182184 <P>My results are like...</P> <PRE><CODE>src_ip src_geo count 55.89.12.11 US 25 </CODE></PRE> <P>I want the result to be like...</P> <PRE><CODE>src_ip and src geo count 55.89.12.11 - US 25 </CODE></PRE> <P>I want this so I can create a chart that shows the src_ip associated with a country and the count.</P> <P>the src_ip and src_geo - I want this to be a new field </P> Mon, 28 Sep 2020 09:57:58 GMT https://community.splunk.com/t5/Splunk-Search/combining-the-results-into-one-field/m-p/88554#M182184 mcbradford 2020-09-28T09:57:58Z https://community.splunk.com/t5/Splunk-Search/combining-the-results-into-one-field/m-p/88555#M182185 <P>Use <CODE>eval</CODE> to concatenate the field values together into a new field:</P> <PRE><CODE>&lt;yourbasesearch&gt; | eval src_ip_and_src_geo=src_ip." - ".src_geo | stats count by src_ip_and_src_geo </CODE></PRE> Fri, 07 Oct 2011 20:19:57 GMT https://community.splunk.com/t5/Splunk-Search/combining-the-results-into-one-field/m-p/88555#M182185 Ayn 2011-10-07T20:19:57Z https://community.splunk.com/t5/Splunk-Search/combining-the-results-into-one-field/m-p/88556#M182186 <P>When I did this - my count was 1 for each, so I made a few changes..</P> <P>direction="external" sourcetype="sidewinder" action=blocked src_geo="US" OR src_geo="CA" | top src_ip, src_geo showperc=f | eval src_ip_and_src_geo=src_ip." - ".src_geo | fields - src_ip fields - src_geo</P> <P>This looks like I want it to, but it will not chart?</P> Mon, 28 Sep 2020 09:58:01 GMT https://community.splunk.com/t5/Splunk-Search/combining-the-results-into-one-field/m-p/88556#M182186 mcbradford 2020-09-28T09:58:01Z https://community.splunk.com/t5/Splunk-Search/combining-the-results-into-one-field/m-p/88557#M182187 <P>I figured it out.. </P> <PRE><CODE>direction="external" sourcetype="sidewinder" action=blocked src_geo="US" OR src_geo="CA" | eval src_ip_and_src_geo=src_ip." - ".src_geo | top src_ip_and_src_geo showperc=f </CODE></PRE> Fri, 07 Oct 2011 20:34:49 GMT https://community.splunk.com/t5/Splunk-Search/combining-the-results-into-one-field/m-p/88557#M182187 mcbradford 2011-10-07T20:34:49Z