Splunk Search

Combine 2 fields to create a new field?

the_wolverine
Champion

I have a search that generates a list of IP addresses and usernames by time. I'd like to dedup the value of ip address + username. I cannot dedup just one (ip OR username) because the IP addresses get recycled and will get reassigned to another user.

Is it possible to combine my 2 fields (ip_address + username) to create a 3rd field that I can use for dedup purposes?

Tags (1)
1 Solution

ftk
Motivator

You could concatenate the fields together:

your search | eval new_field = field1."-".field2

"-" in this example is a separator -- you can use anything (or nothing) there. To just concat the fields do field1.field2

View solution in original post

ftk
Motivator

You could concatenate the fields together:

your search | eval new_field = field1."-".field2

"-" in this example is a separator -- you can use anything (or nothing) there. To just concat the fields do field1.field2

ssrdc
New Member

Nice answer

0 Karma

labani
Explorer

thanks a lot. this is really useful. i've got exactly what i wanted.

0 Karma

aleem
SplunkTrust
SplunkTrust

many thanks for this tip

Be the best version of you
0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...