topic Re: Concatenate fields into a single string in Splunk Search

Concatenate fields into a single string

efelder0 — Mon, 28 Sep 2020 10:03:50 GMT

I have four fields: Signature_Name, Vendor_Signature, Incident_Detail_URL, Analyst_Assessment that I need to concatenate into one field (single string) called 'Event Detail'. Additionally, I need to append a semi-colon at the end of each field. How can this be done?

Re: Concatenate fields into a single string

bbingham — Mon, 07 Nov 2011 16:16:27 GMT

| eval Event_Detail=Signature_Name+";"+Vendor_Signature+";"+Incident_Detail_URL+";"+Analyst_Assessment+";"

Re: Concatenate fields into a single string

Ayn — Mon, 07 Nov 2011 16:24:56 GMT

Use eval:

... | eval Event_Detail= Signature_Name.";".Vendor_Signature.";".Incident_Detail_URL.";".Analyst_Assessment

Re: Concatenate fields into a single string

efelder0 — Mon, 28 Sep 2020 10:04:00 GMT

OK, thanks. That was helpful. However, when I have multiple values in the Signature_Name field, I get no values when I try to concatenate into the Event_Detail field.

Here is my search string:

sourcetype="incident"| sort +Severity | lookup geoip clientip as SourceIP_Address| lookup subnetlookup ip as SourceIP_Address OUTPUT subnet_name AS location | eval
client_country=replace(client_country," ","") | strcat client_city ", " client_region " " client_country mylocation | eval final_location=if(mylocation==", ",location,mylocation) | rex field=final_location "(?.) (?.)" | eval Event_Detail=Signature_Name+ ";" +Vendor_Signature+ ";" +Incident_Detail_URL+ ";" +Analyst_Assessment | table CreateTimeStamp_GMT Data_Source Reference_Number SourceIP_Address SIP_Region SIP_Country Severity Incident_Category Incident_Classification Event_Detail | outputcsv SymantecReport.csv

Re: Concatenate fields into a single string

leonphelps_s — Thu, 03 Nov 2016 16:38:13 GMT

Did you ever figure this out? "No values" when there are multiple values in the field.

Re: Concatenate fields into a single string

cmerriman — Tue, 29 Sep 2020 11:40:33 GMT

for the issue with MV fields and concatenation, you can always use mvjoin first to get all of the Signature Names comma separated (or any other delim)

sourcetype="incident"| sort +Severity | lookup geoip clientip as SourceIP_Address| lookup subnetlookup ip as SourceIP_Address OUTPUT subnet_name AS location | eval
client_country=replace(client_country," ","") | strcat client_city ", " client_region " " client_country mylocation | eval final_location=if(mylocation==", ",location,mylocation) | rex field=final_location "(?.) (?.)"
| eval Signature_Name=mvjoin(Signature_Name,", ")
| eval Event_Detail=Signature_Name+ ";" +Vendor_Signature+ ";" +Incident_Detail_URL+ ";" +Analyst_Assessment | table CreateTimeStamp_GMT Data_Source Reference_Number SourceIP_Address SIP_Region SIP_Country Severity Incident_Category Incident_Classification Event_Detail | outputcsv SymantecReport.csv

Re: Concatenate fields into a single string

leonphelps_s — Thu, 03 Nov 2016 18:07:33 GMT

My issue ended up being a command ordering issue. Inadvertently had the eval command before the mv