Create new field by combining 2 fields from same index.

onthakur — Thu, 18 Jan 2024 17:15:06 GMT

I got 2 fields from same splunk index
field1 have rows 1,2,3,4,5 and field2 have rows 10,12
I want new field3 with data from both field1 and field2.

Please suggest.

field1		field2
1		10
2		12
3
4
5

field3
1
2
3
4
5
10
12

Re: Create new field by combining 2 fields from same index.

dtburrows3 — Thu, 18 Jan 2024 17:35:42 GMT

Notice that your requested output has more rows than the original input rows. To do this would require some sort of transformation, one way could to use an mvexpand method and would look something like this.

<base_search> | eval field3=mvappend(field1, field2) | fields + field3 | mvexpand field3 | sort 0 +field3

You can see in the screenshot that field3 is in your requested format

Full SPL to replicate

Another method would be append (subsearches can be truncated if you hit any splunk limits)
something like this

Full SPL to replicate

I bet there is also a slick way of using appendpipe command to achieve this as well.

<base_search> | appendpipe [ | stats values(field2) as field2 ] | eval field3=coalesce(field1, field2) | mvexpand field3

output looks like this

Full SPL to replicate

topic Re: Create new field by combining 2 fields from same index. in Splunk Search

Create new field by combining 2 fields from same index.

Re: Create new field by combining 2 fields from same index.