How to combine two tokens (with NO Space) in an alert email?

[adamfiore]

I have an email alert that I've configured that I would like to include two tokens without a space in the body of the email.

The two fields are:

&nbsp - member_nt_domain = URT\
&nbsp - member = jsmith

So, I would like the output in the email formatted like this: URT\jsmith. The reason that I can't have the space is that the domain token includes the backslash - otherwise adding "\" in between the two tokens would produce the desired result.

I have tried the following, but none seem to work. (I've included the result that each produces in the section after the -->)

$result.member_nt_domain result.member$  -->  *blank*
$result.member_nt_domain$ $result.member$  -->  URT\ jsmith
$result.member_nt_domain$$result.member$  -->  $result.member_nt_domain$result.member$
$result.member_nt_domain$result.member$  -->  URT\result.member$

Thanks for the help.

[kmaron · Accepted solution]

| eval domainmember = member_nt_domain.member

then use the token: $result.domainmember$

[adamfiore]

Perfect, thanks!

[kmaron]

could you do an eval in the actual search to make a new token that is exactly what you want?

[s2_splunk]

Haven't tried this with the tokens themselves, but you could use an eval in your alerting search to create a new field with the combined/concatenated value and us that as the token instead.

[adamfiore]

Thanks for the suggestion. I'm just getting start with Splunk - any chance you could provide an example of how to do this. Here is how the search is currently written. Appreciate it.

EventCode=4732 Group_Name=Administrators Group_Domain=Builtin | fields *

[s2_splunk]

See @kmaron's answer below. You can probably remove the "| fields *"