topic Re: How to combine two fields, but add quotations marks around one of the fields prior to combining? in Splunk Search

How to combine two fields, but add quotations marks around one of the fields prior to combining?

minkyuk — Fri, 26 Jun 2015 14:56:22 GMT

Hello folks,

I am trying to combine two fields by string; however, I need to put quotation marks around one of the fields prior to combining.

A            B
coc19        /afs/po101        
coc20        D:

I want the output to look like:

COMBINED STRING
coc19 "/afs/po101"
coc20 "D:"

What should I do to eval combstr = A +" "+B to add quotation marks?

I would appreciate your input

Thanks

richgalloway — Fri, 26 Jun 2015 15:04:20 GMT

This works for me:

eval combstr=A+" "+"\""+B+"\""

minkyuk — Fri, 26 Jun 2015 15:23:30 GMT

Thank you sir

chimell — Fri, 26 Jun 2015 15:42:26 GMT

Hi
Try this search code

 ......|eval COMBINED_STRING=A." "."\"".B."\""