topic How to join different fields together? in Splunk Search

How to join different fields together?

jhilton90 — Tue, 20 Jun 2023 02:20:13 GMT

I have an index called index=advanced_hunting and in this index there is a field called category, where there are several categories like

AdvancedHunting-DeviceFileEvents

AdvancedHunting-DeviceNetworkEvents etc

I'm trying to look into the AdvancedHunting-DeviceFileEvents category to look at what files have been deleted, but the logs in that specific category don't feature the properties.AccountName i.e. the person, it does however, have a filed called properties.DeviceName.

However, the category of AdvancedHunting-DeviceLogonEvents does have a field called properties.AccountName, as well as properties.DeviceName.

So I was wondering if it's possible to connect the properties.AccountName and properties.DeviceName together so I can see who has deleted something

Re: How to join different fields together

gcusello — Mon, 19 Jun 2023 14:24:57 GMT

Hi @jhilton90,

in Splunk it's possible to join two fields using eval command:

| eval new_field='properties.AccountName'."-".'properties.DeviceName'

there could be an issue related to the dot in the field name, so please try this:

| rename properties.AccountName AS AccountName properties.DeviceName AS DeviceName | eval new_field=AccountName."-".DeviceName

Ciao.

Giuseppe

Re: How to join different fields together

gcusello — Wed, 21 Jun 2023 13:39:21 GMT

Hi @jhilton90 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉