topic Re: How to combine two fields with eval ? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-fields-with-eval/m-p/488136#M193911 <P>| search "body.refundTenderType"=* <BR /> | search "body.refundTenders{}.paymentType"=* <BR /> | rename body.refundTenderType as "RefundTender" <BR /> | rename body.refundTenders{}.paymentType as "RefundTenderPaymentType" <BR /> | stats count AS Count BY RefundTender RefundTenderPaymentType, body.orderNumber <CODE>add this here</CODE><BR /> | eval Refund = RefundTender . "-" . RefundTenderPaymentType <BR /> | table Refund , body.orderNumber <BR /> | chart count by Refund</P> <P>Try this if it works</P> Thu, 21 Nov 2019 13:22:48 GMT siddharthkhatsu 2019-11-21T13:22:48Z How to combine two fields with eval ? https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-fields-with-eval/m-p/488131#M193906 <P>paymenttype RefunpaymentType</P> <P>DEBIT DEBIT<BR /> GIFTCARD PGIFTCARD<BR /> ORIGINAL CREDITCARD<BR /> ORIGINAL DEBITCARD</P> <P>I am trying to get output like this and also count of this combinations</P> <P>Refund Count</P> <P>DEBIT-DEBIT 100<BR /> GIFTCARD -PGIFTCARD 50<BR /> ORIGINAL-CREDITCARD 75<BR /> ORIGINAL-DEBITCARD 88</P> <P>Can any one help</P> Wed, 20 Nov 2019 21:19:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-fields-with-eval/m-p/488131#M193906 monipinni 2019-11-20T21:19:39Z Re: How to combine two fields with eval ? https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-fields-with-eval/m-p/488132#M193907 <P>try this:</P> <PRE><CODE>| eval field=paymenttype+"-"+RefunpaymentType | stats count by field </CODE></PRE> Wed, 20 Nov 2019 21:30:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-fields-with-eval/m-p/488132#M193907 mayurr98 2019-11-20T21:30:11Z Re: How to combine two fields with eval ? https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-fields-with-eval/m-p/488133#M193908 <P>Like this:</P> <PRE><CODE>... | stats count AS Count BY paymenttype RefunpaymentType | eval Refund = paymenttype . "-" . RefunpaymentType | table Refund Count </CODE></PRE> Wed, 20 Nov 2019 22:14:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-fields-with-eval/m-p/488133#M193908 woodcock 2019-11-20T22:14:01Z Re: How to combine two fields with eval ? https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-fields-with-eval/m-p/488134#M193909 <P>@woodcock : tried this search i got results but count is displaying is 1 instead of accurate count values</P> <P><CODE>| search "body.refundTenderType"=* | search "body.refundTenders{}.paymentType"=* | rename body.refundTenderType as "RefundTender" | rename body.refundTenders{}.paymentType as "RefundTenderPaymentType" | stats count AS Count BY RefundTender RefundTenderPaymentType | eval Refund = RefundTender . "-" . RefundTenderPaymentType | table Refund , body.orderNumber | chart count by Refund</CODE></P> Thu, 21 Nov 2019 02:35:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-fields-with-eval/m-p/488134#M193909 monipinni 2019-11-21T02:35:28Z Re: How to combine two fields with eval ? https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-fields-with-eval/m-p/488135#M193910 <P>1 extra step that is not in my answer; do this:</P> <PRE><CODE>... | search "body.refundTenderType"=* AND "body.refundTenders{}.paymentType"=* | rename body.refundTenderType as "RefundTender", body.refundTenders{}.paymentType as "RefundTenderPaymentType" | stats count AS Count BY RefundTender RefundTenderPaymentType | eval Refund = RefundTender . "-" . RefundTenderPaymentType | table Refund Count </CODE></PRE> Thu, 21 Nov 2019 03:26:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-fields-with-eval/m-p/488135#M193910 woodcock 2019-11-21T03:26:22Z Re: How to combine two fields with eval ? https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-fields-with-eval/m-p/488136#M193911 <P>| search "body.refundTenderType"=* <BR /> | search "body.refundTenders{}.paymentType"=* <BR /> | rename body.refundTenderType as "RefundTender" <BR /> | rename body.refundTenders{}.paymentType as "RefundTenderPaymentType" <BR /> | stats count AS Count BY RefundTender RefundTenderPaymentType, body.orderNumber <CODE>add this here</CODE><BR /> | eval Refund = RefundTender . "-" . RefundTenderPaymentType <BR /> | table Refund , body.orderNumber <BR /> | chart count by Refund</P> <P>Try this if it works</P> Thu, 21 Nov 2019 13:22:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-fields-with-eval/m-p/488136#M193911 siddharthkhatsu 2019-11-21T13:22:48Z