Getting Data In

How can i append the values of one field to another field?

kartik13
Communicator

I have two different fields, but they have the same type of value for eg. "host". So How can I join two fields to have one field with all the hosts?
I have to use some tags with the search, so I'm trying to find some way to deal with this problem, and the tag is related to host and classifies the host based on the environment.

Tags (3)
0 Karma
1 Solution

chimell
Motivator
try this search 
| set union [search  ...... | fields host ] [search ...... | fields host ]|table host 

just replace ....... by something and try

View solution in original post

chimell
Motivator
try this search 
| set union [search  ...... | fields host ] [search ...... | fields host ]|table host 

just replace ....... by something and try

chimell
Motivator

thank for your accepted answer

0 Karma

emiller42
Motivator

Couple ways to tackle this.

  • At search time, you can coalesce multiple fields as 'host' ...| eval host=coalesce(field1, field2, ..., fieldN)
  • You can create field aliases to give fields multiple names. Example, you have some data which has a src_host field, and you'd like that field to be included in any host=... searches. Go to Settings > Fields > Field Aliases and add a new config saying src_host = host
0 Karma

kartik13
Communicator

i want to use a tag i want to include the tag after i have joined the two fields .. is there any way to do tht becuase tag doent produce any result if i use aftr eval command

0 Karma

emiller42
Motivator

Do the tags work if you create a field alias?

0 Karma

ramdaspr
Contributor

can you add a sample of the input data and a sample output you are trying to achieve?

kartik13
Communicator

2015-03-04T06:24:25+00:00 *_Alarm WARN Profiler Queue Size Limit Reached : Server=rtp-prd-02; Profiler Error Message=1030 EventHandler events dropped;host=****

i want to make host and server as one field . with having all values in host plus with the values of Server.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>