Adding strings from 2 fields into 1

[Zyon]

Hello!

I am trying to combine 2 fields into 1 field.
One of my field is named date_mday, which stores all the days in the month, 1-30/31
Another field is named date_month, which stores all the month in the year, Jan-Dec

I need to combine these 2 fields into one field. For example, "8 Aug" or "20 Jan".
May i ask if there is any ideas for me to do so?

Thanks.

EDIT
Now, I am able to produce a graph, however is there any way for me to sort the time?
Graph: http://i40.tinypic.com/2ai0zzn.png

[rturk · Accepted solution]

Hi Zyon,

try this:

<search here> | eval date_readable=date_mday." ".date_month

You have to remember that this will just be a string and Splunk will not treat it as a date for the purposes of sorting.

Hope this helps 🙂

[Zyon]

Alright. Thanks a lot.

[rturk]

This sounds like an issue with timestamp extraction in the original event. Unfortunately I can't help you right now, but if you put another question up, I think someone will be able to assist you shortly!

[Zyon]

Alright! But i have another doubt and have no idea on how it could be done. It is asked above.

[rturk]

Great! If you could mark the answer as accepted (the tick box) that'll help other people who are searching with the same problem 🙂

Happy Splunking!

[Zyon]

Thanks, it works!