topic Re: Combining unique field values in Splunk Search

Combining unique field values

sahr — Fri, 20 Oct 2017 03:15:53 GMT

I have the following problem I would like to solve

Numbers1 Numbers 2
1 6
2 7
3 8
4 9
5 10

I want to concatenate so it will be like this
Number_combined
1
2
3
4
5
6
7
8
9
10

I have tried field aliases, mvjoin, coalescence, eval with the (.) but still can't seem to figure it out.

Help please.

Thanks,

Re: Combining unique field values

lloydknight — Fri, 20 Oct 2017 04:11:48 GMT

Hello sahr

Kindly check this similar question.
https://answers.splunk.com/answers/49394/merge-two-fields-into-one-field.html

Hope it helps!

Thanks!

Re: Combining unique field values

sahr — Fri, 20 Oct 2017 04:12:28 GMT

So I was able to solve it with the help of a good friend. I used |makeresults command to just test it.

I used the random() function to just generate some random numbers

So imagine numbers 1=123
So imagine numbers 2=456
So imagine numbers 3=789

fillnull fills in the values from the fields we are using
we eval to basically combine the fields
then finally we split by the delimiter/separator(in this case ".") we used in our previous eval

I hope I explained this well.

Re: Combining unique field values

sahr — Fri, 20 Oct 2017 04:14:19 GMT

Thanks a lot @lloydknight. I was able to figure it out using the same concept. I just missed a couple of steps.

Thanks,
Sahr