topic Re: How to combine two fields into one after if without losing values in Splunk Search

How to combine two fields into one after if without losing values

ebs — Tue, 28 Sep 2021 23:57:43 GMT

Hi,

I have a uri_path that I want to combine into a single value, and put the combined value back into the original field and I have achieved that with the below search:

index=ping_sandbox uri_path=/as/*/resume/as/authorization
| eval uri=if(like(uri_path, "/as/%/resume/as/authorization"), "resume/as/authorization", uri)
| eval uri_path=mvappend(uri, url_path)

However, not every uri_path is /as/*/resume/as/authorization, and when I remove the uri_path search value, all the other uri_path values are gone.

For example, here's 3 values /1 /2 /3, and if I do the above eval statements for /as/*/resume/as/authorization I don't have /1 /2 or /3 anymore.

Does anyone have any advice on how to do the above eval statements while still retaining the rest of the field values? I only want the eval statements applied if /as/*/resume/as/authorization is present as well

Re: How to combine two fields into one after if without losing values

richgalloway — Wed, 29 Sep 2021 00:25:37 GMT

Have you tried this?

index=ping_sandbox uri_path=* | eval uri=if(like(uri_path, "/as/%/resume/as/authorization"), "resume/as/authorization", uri) | eval uri_path=mvappend(uri, url_path)

Re: How to combine two fields into one after if without losing values

ebs — Wed, 29 Sep 2021 01:16:22 GMT

Yes, but all the field values are overwritten by the uri field value from the eval if

Re: How to combine two fields into one after if without losing values

bowesmana — Wed, 29 Sep 2021 04:48:37 GMT

It looks like you have 2 typos in your SPL

| eval uri=if(like(uri_path, "/as/%/resume/as/authorization"), "resume/as/authorization", uri_path) | eval uri_path=mvappend(uri, uri_path)

3rd param to if should be uri_path - you had uri

2nd param to mvappend() was url_path, should be uri_path

HOWEVER, you can do this with a single line

| eval uri_path=if(like(uri_path, "/as/%/resume/as/authorization"), mvappend("resume/as/authorization", uri_path), uri_path)