Archive

concatenating more than one field

abhayneilam
Contributor

Hi,

I have three fields :

field1 field2 field3
delhi
delhi
kol
delhi mumbai

delhi kol

mumbai kolkata andhra

Output should be like :

Final_Field
delhi
delhi
kol
delhi,mumbai
delhi,kol
mumbai,kolkata,andhra

Please help !!

Thanks

0 Karma

yannK
Splunk Employee
Splunk Employee

use an eval to concatenate the fields, and in the case a field is missing, use a sed command to remove the extra separation commas.

mysearch | fillnull value="" field1 field2 field3 | eval myfield=field1.",".field2.",".field3 | rex field=myfield mode=sed "s/([,]*)}/,/g" | table myfield

remark : sed command not tested, please try or replace by some logic in the eval.

yannK
Splunk Employee
Splunk Employee

Thanks Kristian, the fillnull is required indeed, let me add it.

0 Karma

kristian_kolb
Ultra Champion

Thats what one would like to think, but if either of the fields is missing altogether, the eval fails.

You'd have to use fillnull or similar first.

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!