<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Concatenate string with a number using eval in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-concatenate-string-with-a-number-using-eval/m-p/618982#M215130</link>
    <description>&lt;P&gt;Sorry, I am being stupid. '.' operator allows concatenation of numeric and alphabets while '+' allows only concatenation of alphabets and numeric.&lt;/P&gt;&lt;P&gt;Regards&lt;/P&gt;&lt;P&gt;Suman P.&lt;/P&gt;</description>
    <pubDate>Mon, 31 Oct 2022 17:12:50 GMT</pubDate>
    <dc:creator>SumanPalisetty</dc:creator>
    <dc:date>2022-10-31T17:12:50Z</dc:date>
    <item>
      <title>Is it possible to concatenate string with a number using eval?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-concatenate-string-with-a-number-using-eval/m-p/618978#M215127</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;
&lt;P&gt;Can we concatenate a string with a number using eval with '.' operator? I got to know that from a video, but when i do it, I am able to do it. I don't know what is going on. Kindly help.&lt;/P&gt;
&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="eval1.png" style="width: 953px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/22245i69CCE28DEF47C118/image-size/large?v=v2&amp;amp;px=999" role="button" title="eval1.png" alt="eval1.png" /&gt;&lt;/span&gt;&lt;/P&gt;
&lt;P&gt;Regards&lt;/P&gt;
&lt;P&gt;Suman P.&lt;/P&gt;</description>
      <pubDate>Mon, 31 Oct 2022 19:13:13 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-concatenate-string-with-a-number-using-eval/m-p/618978#M215127</guid>
      <dc:creator>SumanPalisetty</dc:creator>
      <dc:date>2022-10-31T19:13:13Z</dc:date>
    </item>
    <item>
      <title>Re: Concatenate string with a number using eval</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-concatenate-string-with-a-number-using-eval/m-p/618980#M215129</link>
      <description>&lt;P&gt;For some of your events the action field is null/not present&lt;/P&gt;</description>
      <pubDate>Mon, 31 Oct 2022 17:09:27 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-concatenate-string-with-a-number-using-eval/m-p/618980#M215129</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2022-10-31T17:09:27Z</dc:date>
    </item>
    <item>
      <title>Re: Concatenate string with a number using eval</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-concatenate-string-with-a-number-using-eval/m-p/618982#M215130</link>
      <description>&lt;P&gt;Sorry, I am being stupid. '.' operator allows concatenation of numeric and alphabets while '+' allows only concatenation of alphabets and numeric.&lt;/P&gt;&lt;P&gt;Regards&lt;/P&gt;&lt;P&gt;Suman P.&lt;/P&gt;</description>
      <pubDate>Mon, 31 Oct 2022 17:12:50 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-concatenate-string-with-a-number-using-eval/m-p/618982#M215130</guid>
      <dc:creator>SumanPalisetty</dc:creator>
      <dc:date>2022-10-31T17:12:50Z</dc:date>
    </item>
    <item>
      <title>Re: Concatenate string with a number using eval?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-concatenate-string-with-a-number-using-eval/m-p/618994#M215134</link>
      <description>&lt;UL&gt;&lt;LI&gt;&lt;DIV class=""&gt;The plus ( + ) operator accepts two numbers for addition, or &lt;STRONG&gt;two strings for concatenation.&lt;/STRONG&gt;&lt;/DIV&gt;&lt;/LI&gt;&lt;LI&gt;&lt;DIV class=""&gt;&lt;STRONG&gt;The period ( . ) operator concatenates both strings and number.&lt;/STRONG&gt; Numbers are concatenated in their string represented form.&lt;/DIV&gt;&lt;/LI&gt;&lt;/UL&gt;&lt;P&gt;Check if the field "action" has null values. If it does, whole eval expression will be null. In stead, try like this :&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;source= "2access_30DAY.log"
| eval "new_field"=coalesce('action',"Default String Here, change it per your need"). 10 | table "new_field"&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Mon, 31 Oct 2022 18:30:48 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-concatenate-string-with-a-number-using-eval/m-p/618994#M215134</guid>
      <dc:creator>somesoni2</dc:creator>
      <dc:date>2022-10-31T18:30:48Z</dc:date>
    </item>
  </channel>
</rss>

