Archive
Highlighted

concatenating more than one field

Contributor

Hi,

I have three fields :

field1 field2 field3
delhi
delhi
kol
delhi mumbai

delhi kol

mumbai kolkata andhra

Output should be like :

Final_Field
delhi
delhi
kol
delhi,mumbai
delhi,kol
mumbai,kolkata,andhra

Please help !!

Thanks

0 Karma
Highlighted

Re: concatenating more than one field

Splunk Employee
Splunk Employee

use an eval to concatenate the fields, and in the case a field is missing, use a sed command to remove the extra separation commas.

mysearch | fillnull value="" field1 field2 field3 | eval myfield=field1.",".field2.",".field3 | rex field=myfield mode=sed "s/([,]*)}/,/g" | table myfield

remark : sed command not tested, please try or replace by some logic in the eval.

Highlighted

Re: concatenating more than one field

Ultra Champion

Thats what one would like to think, but if either of the fields is missing altogether, the eval fails.

You'd have to use fillnull or similar first.

Highlighted

Re: concatenating more than one field

Splunk Employee
Splunk Employee

Thanks Kristian, the fillnull is required indeed, let me add it.

0 Karma