https://community.splunk.com/t5/Splunk-Search/How-to-concatenate-strings-with-special-characters/m-p/204069#M59284 <P>You just need spacing, like this:</P> <PRE><CODE>...| eval newField = Start_time . "[" . duration . "]" </CODE></PRE> Thu, 03 Sep 2015 13:24:18 GMT woodcock 2015-09-03T13:24:18Z https://community.splunk.com/t5/Splunk-Search/How-to-concatenate-strings-with-special-characters/m-p/204068#M59283 <P>Hi,</P> <P>How can I concatenate <CODE>Start time</CODE> and <CODE>duration</CODE> in below format. Right now I am using this, but it is only half working.</P> <PRE><CODE>... | eval newField= Start_time."".duration </CODE></PRE> <P>Desired format : 01:40[20m]</P> Thu, 03 Sep 2015 07:35:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-concatenate-strings-with-special-characters/m-p/204068#M59283 tondapi 2015-09-03T07:35:19Z https://community.splunk.com/t5/Splunk-Search/How-to-concatenate-strings-with-special-characters/m-p/204069#M59284 <P>You just need spacing, like this:</P> <PRE><CODE>...| eval newField = Start_time . "[" . duration . "]" </CODE></PRE> Thu, 03 Sep 2015 13:24:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-concatenate-strings-with-special-characters/m-p/204069#M59284 woodcock 2015-09-03T13:24:18Z