https://community.splunk.com/t5/Splunk-Search/field-combination-does-not-work-properly/m-p/153206#M185607 <P>You can use mvexpand before your field concatenation.</P> <UL> <LI><P>mvexpand<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Mvexpand" target="_blank">http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Mvexpand</A></P> <P>sourcetype="F5:iRule:WebAccess"| head 100000 | sort -req_elapsed_time|head 3|stats count by url client_address req_elapsed_time server_name|stats sum(count) as count list(url) as a list(server_name) as b by server_name | mvexpand a | mvexpand b | eval steps=b."-".a | fields steps count</P></LI> </UL> Mon, 28 Sep 2020 18:28:31 GMT pedromvieira 2020-09-28T18:28:31Z https://community.splunk.com/t5/Splunk-Search/field-combination-does-not-work-properly/m-p/153204#M185605 <P>Hi,<BR /> I have the following search on splunk indexer.<BR /> Although field "a" and "b" return results, field "steps" does not return stable results.(only one or zero result is returned).<BR /> thanks</P> <P>sourcetype="F5:iRule:WebAccess"|sort -req_elapsed_time|head 3|stats count by url client_address req_elapsed_time server_name|stats sum(count) as count list(url) as a list(server_name) as b by server_name | eval steps=b."-".a| fields steps count</P> Mon, 28 Sep 2020 18:23:44 GMT https://community.splunk.com/t5/Splunk-Search/field-combination-does-not-work-properly/m-p/153204#M185605 can_surer 2020-09-28T18:23:44Z https://community.splunk.com/t5/Splunk-Search/field-combination-does-not-work-properly/m-p/153205#M185606 <P><CODE>eval</CODE> won't like doing string concatenations on multivalued fields. It does that on single-valued fields only.</P> Thu, 18 Dec 2014 12:23:45 GMT https://community.splunk.com/t5/Splunk-Search/field-combination-does-not-work-properly/m-p/153205#M185606 Ayn 2014-12-18T12:23:45Z https://community.splunk.com/t5/Splunk-Search/field-combination-does-not-work-properly/m-p/153206#M185607 <P>You can use mvexpand before your field concatenation.</P> <UL> <LI><P>mvexpand<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Mvexpand" target="_blank">http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Mvexpand</A></P> <P>sourcetype="F5:iRule:WebAccess"| head 100000 | sort -req_elapsed_time|head 3|stats count by url client_address req_elapsed_time server_name|stats sum(count) as count list(url) as a list(server_name) as b by server_name | mvexpand a | mvexpand b | eval steps=b."-".a | fields steps count</P></LI> </UL> Mon, 28 Sep 2020 18:28:31 GMT https://community.splunk.com/t5/Splunk-Search/field-combination-does-not-work-properly/m-p/153206#M185607 pedromvieira 2020-09-28T18:28:31Z https://community.splunk.com/t5/Splunk-Search/field-combination-does-not-work-properly/m-p/153207#M185608 <P>Thanks for your recommendation.<BR /> It solved my issue.</P> Tue, 23 Dec 2014 08:52:54 GMT https://community.splunk.com/t5/Splunk-Search/field-combination-does-not-work-properly/m-p/153207#M185608 can_surer 2014-12-23T08:52:54Z