topic Re: In a search combine two-three field values(columns) into one field in Splunk Search

In a search combine two-three field values(columns) into one field

man03359 — Wed, 31 Jan 2024 15:07:48 GMT

Hi,

I have an output like this -

Location	EventName	ErrorCode	Summary
server1	Mssql.LogBackupFailed	BackupAgentError	Failed backup....
server2	Mssql.LogBackupFailed	BackupAgentError	Failed backup....

Now I am trying to combine all the values of Location, EventName, ErrorCode and Summary into one field called "newfield" , lets say using a comma "," or ";"

I am trying this command -

| eval newfield= mvappend(LocationName,EventName,ErrorCode,summary)

but the output it is giving is -

server1

Mssql.LogBackupFailed

BackupAgentError

Failed backup....

Output I am expecting is -

server1,Mssql.LogBackupFailed,BackupAgentError,Failed backup

Re: In a search combine two-three field values(columns) into one field

gcusello — Wed, 31 Jan 2024 15:12:39 GMT

Hi @man03359 ,

if you want the values of the fields separated by comma, you should use eval in this way:

| eval newfield=LocationName.",".EventName.",".ErrorCode.",".summary

Ciao.

Giuseppe

Re: In a search combine two-three field values(columns) into one field

ITWhisperer — Wed, 31 Jan 2024 15:14:18 GMT

| eval newfield= mvjoin(mvappend(LocationName,EventName,ErrorCode,summary),",")