Splunk Enterprise Security

Combining two fields with a constant string between

Braagi
New Member

I am pulling two fields from a CSV based off of a field in live logs, then combining them into one field with a constant string in between them.
What I have tried thus far :

|eval field3=field1." - ".field2
|eval field3=field1 + " - " + field2
|eval field3=if(field1="", field1." - ".field2, "didnt work")
|eval field3=if(field1="
", field1 + " - " + field2, "didnt work")
|eval field3=if(NOT (field1=""), field1." - ".field2, "didnt work")
|eval field3=if( NOT (field1=""), field1 + " - " + field2, "didnt work")

None of these work. Even with a fillnull before them.

0 Karma

sumanssah
Communicator

I faced this issue in recent past

To appraise if you are using above SPL with datamodel , I would suggest you use drop_dm_object_name("datamodel_name") before using eval condition

Example

| `drop_dm_object_name("datamodel_name")` 
| eval field3= field1 + ";" + field2
| makemv delim=";" field3

Reference: https://answers.splunk.com/answers/49394/merge-two-fields-into-one-field.html

0 Karma

Braagi
New Member

There no datamodel, straight index and sourcetype.

0 Karma

Braagi
New Member

I think what the underlying issue is that its coming from a CSV. I can get them to display individually, but when I try to combine them in the query... its a no-go.

0 Karma

to4kawa
Ultra Champion
|eval field3=mvappend(field1,field2)
|eval field3=mvjoin(field3,"-")

maybe, some fields has null.

0 Karma

Braagi
New Member

This one had some rather unexpected results. "field1" repeated a random number of times, followed by the same number of "field2". The "-" seems to be at the front of every entry but the first.

A bit closer, things are showing up but still not quite -> "data - data"

0 Karma

to4kawa
Ultra Champion

the fields are multivalue.
First, you should convert them to single values

0 Karma

vnravikumar
Champion

Hi

Try field1 and field2 with a single quote

| makeresults 
| eval field1="test",field2="test2" 
| eval field3='field1'."-".'field2'
0 Karma

Braagi
New Member

Even though it was basically the first option that was attempted, I tried it with the single-quotes...
...to no avail.

0 Karma

vnravikumar
Champion

Can you please provide some samples of field1 and field2?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...