https://community.splunk.com/t5/Splunk-Search/How-to-concatenate-a-string-with-a-value-containing-special/m-p/134835#M36843 <P>Can you paste what the output of the below code looks like?<BR /> I did a quick test of the code above and it seems to work fine </P> <P>index=myindex | table Account</P> Tue, 10 Feb 2015 23:21:05 GMT ramdaspr 2015-02-10T23:21:05Z https://community.splunk.com/t5/Splunk-Search/How-to-concatenate-a-string-with-a-value-containing-special/m-p/134829#M36837 <P>Hello Everyone,</P> <P>I have a file containing <CODE>Account ="xxx/\xxx/\xxx/\xx"</CODE> value and this needs to be concatenated with a string, say "my account" .</P> <P>when i tried following search:</P> <PRE><CODE>index=myindex | eval description= "my account" + Account | table description </CODE></PRE> <P>getting blank for "description" .</P> <P>Can any one guide me where aI'm going wrong ??? or this is because of the "/\" character in the string?</P> <P>Thanks</P> Tue, 10 Feb 2015 15:30:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-concatenate-a-string-with-a-value-containing-special/m-p/134829#M36837 snehal8 2015-02-10T15:30:39Z https://community.splunk.com/t5/Splunk-Search/How-to-concatenate-a-string-with-a-value-containing-special/m-p/134830#M36838 <P>use .</P> <P>index=myindex | eval description= "my account".Account | table description</P> Tue, 10 Feb 2015 15:53:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-concatenate-a-string-with-a-value-containing-special/m-p/134830#M36838 mzorzi 2015-02-10T15:53:38Z https://community.splunk.com/t5/Splunk-Search/How-to-concatenate-a-string-with-a-value-containing-special/m-p/134831#M36839 <P>I don't think the characters will matter.</P> <P>To prove this, try replacing them with something else?</P> <PRE><CODE>index=myindex | eval rfield=REPLACE(Account, "/", "-") | eval description="my account" + rfield | table description </CODE></PRE> Tue, 10 Feb 2015 15:57:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-concatenate-a-string-with-a-value-containing-special/m-p/134831#M36839 kendrickt 2015-02-10T15:57:26Z https://community.splunk.com/t5/Splunk-Search/How-to-concatenate-a-string-with-a-value-containing-special/m-p/134832#M36840 <P>Thanks for reply @mzorzi. but it is not working. </P> Tue, 10 Feb 2015 16:00:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-concatenate-a-string-with-a-value-containing-special/m-p/134832#M36840 snehal8 2015-02-10T16:00:00Z https://community.splunk.com/t5/Splunk-Search/How-to-concatenate-a-string-with-a-value-containing-special/m-p/134833#M36841 <P>Thanks for reply @kendrickt.. same not getting display !!!</P> Tue, 10 Feb 2015 16:31:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-concatenate-a-string-with-a-value-containing-special/m-p/134833#M36841 snehal8 2015-02-10T16:31:01Z https://community.splunk.com/t5/Splunk-Search/How-to-concatenate-a-string-with-a-value-containing-special/m-p/134834#M36842 <P>Do the quote characters show up in the Account field? If so I wonder if that is throwing it off. Maybe try the following before your eval </P> <PRE><CODE>... | rex field=Account "\"(?&lt;Account&gt;[^\"]+)" | ... </CODE></PRE> Tue, 10 Feb 2015 21:41:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-concatenate-a-string-with-a-value-containing-special/m-p/134834#M36842 Runals 2015-02-10T21:41:38Z https://community.splunk.com/t5/Splunk-Search/How-to-concatenate-a-string-with-a-value-containing-special/m-p/134835#M36843 <P>Can you paste what the output of the below code looks like?<BR /> I did a quick test of the code above and it seems to work fine </P> <P>index=myindex | table Account</P> Tue, 10 Feb 2015 23:21:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-concatenate-a-string-with-a-value-containing-special/m-p/134835#M36843 ramdaspr 2015-02-10T23:21:05Z https://community.splunk.com/t5/Splunk-Search/How-to-concatenate-a-string-with-a-value-containing-special/m-p/134836#M36844 <P>Thanks for reply @ramdaspr. the problem was this string it contain line break, so it was not coming. i used "mvjoin" command for removing line. that it worked !!! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> </P> Wed, 11 Feb 2015 14:10:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-concatenate-a-string-with-a-value-containing-special/m-p/134836#M36844 snehal8 2015-02-11T14:10:47Z https://community.splunk.com/t5/Splunk-Search/How-to-concatenate-a-string-with-a-value-containing-special/m-p/134837#M36845 <P>Hello All,</P> <P>Thanks for your reply, the problem was Account string contain the two values with line break. so i used <CODE>mvjoin</CODE> command to remove line and now it is working perfectly fine.</P> <P>Once again thanks all !! </P> Wed, 11 Feb 2015 14:13:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-concatenate-a-string-with-a-value-containing-special/m-p/134837#M36845 snehal8 2015-02-11T14:13:30Z