https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-fields/m-p/303137#M91207 <P>I am looking to join all the names together and have them report as one name. </P> Thu, 18 May 2017 18:31:52 GMT zkenaga 2017-05-18T18:31:52Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-fields/m-p/303135#M91205 <P>I have multiple fields with the name name_zz_(more after this)</P> <P>How would I be able to merge all of the like tests into one field?</P> Tue, 29 Sep 2020 14:08:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-fields/m-p/303135#M91205 zkenaga 2020-09-29T14:08:15Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-fields/m-p/303136#M91206 <P>You want to merge values (concatenate values) OR each event will have single field but different name but you want to create a common name field?</P> Thu, 18 May 2017 18:22:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-fields/m-p/303136#M91206 somesoni2 2017-05-18T18:22:19Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-fields/m-p/303137#M91207 <P>I am looking to join all the names together and have them report as one name. </P> Thu, 18 May 2017 18:31:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-fields/m-p/303137#M91207 zkenaga 2017-05-18T18:31:52Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-fields/m-p/303138#M91208 <P>right now I have</P> <P>name_zz_1<BR /> name_zz_2<BR /> name_zz_3</P> <P>I would like to have those combined to just report as name_zz</P> Tue, 29 Sep 2020 14:08:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-fields/m-p/303138#M91208 zkenaga 2020-09-29T14:08:26Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-fields/m-p/303139#M91209 <P>So basically, right now you've to do like this to see all values?</P> <PRE><CODE>...some search | table ..some fields.. name_zz_1 name_zz_2 name_zz_3 </CODE></PRE> <P>and you want to do like</P> <PRE><CODE>...some search | table ..some fields.. name_zz </CODE></PRE> <P>Where <CODE>name_zz</CODE> will contain values of all 3 (or any number of fields) <CODE>name_zz_N</CODE> fields?</P> <P>It's generally easier for us if you can post some sample values and corresponding expected output.</P> Thu, 18 May 2017 18:35:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-fields/m-p/303139#M91209 somesoni2 2017-05-18T18:35:11Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-fields/m-p/303140#M91210 <P>If its the first case (multiple fields to be combined into one), try this</P> <PRE><CODE>...some search.. | eval name_zz="" | foreach name_zz_* [| eval name_zz=coalesce('&lt;&lt;FIELD&gt;&gt;'.",","").name_zz] | fields - name_zz_* </CODE></PRE> Thu, 18 May 2017 18:38:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-fields/m-p/303140#M91210 somesoni2 2017-05-18T18:38:06Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-fields/m-p/303141#M91211 <P>Take a look at this post:</P> <P><A href="https://answers.splunk.com/answers/49394/merge-two-fields-into-one-field.html">https://answers.splunk.com/answers/49394/merge-two-fields-into-one-field.html</A></P> Thu, 18 May 2017 18:50:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-fields/m-p/303141#M91211 kmorris_splunk 2017-05-18T18:50:09Z