topic Re: Combine 2 fields to create a new field? in Splunk Search

Combine 2 fields to create a new field?

the_wolverine — Tue, 26 Oct 2010 00:18:51 GMT

I have a search that generates a list of IP addresses and usernames by time. I'd like to dedup the value of ip address + username. I cannot dedup just one (ip OR username) because the IP addresses get recycled and will get reassigned to another user.

Is it possible to combine my 2 fields (ip_address + username) to create a 3rd field that I can use for dedup purposes?

Re: Combine 2 fields to create a new field?

ftk — Tue, 26 Oct 2010 00:22:23 GMT

You could concatenate the fields together:

your search | eval new_field = field1."-".field2

"-" in this example is a separator -- you can use anything (or nothing) there. To just concat the fields do field1.field2

Re: Combine 2 fields to create a new field?

aleem — Fri, 30 Mar 2012 09:16:36 GMT

many thanks for this tip

Re: Combine 2 fields to create a new field?

labani — Wed, 03 Jul 2013 06:09:19 GMT

thanks a lot. this is really useful. i've got exactly what i wanted.

Re: Combine 2 fields to create a new field?

ssrdc — Thu, 19 Jan 2017 19:28:30 GMT

Nice answer