Splunk Search

Combine 2 fields to create a new field?

the_wolverine
Champion

I have a search that generates a list of IP addresses and usernames by time. I'd like to dedup the value of ip address + username. I cannot dedup just one (ip OR username) because the IP addresses get recycled and will get reassigned to another user.

Is it possible to combine my 2 fields (ip_address + username) to create a 3rd field that I can use for dedup purposes?

Tags (1)
1 Solution

ftk
Motivator

You could concatenate the fields together:

your search | eval new_field = field1."-".field2

"-" in this example is a separator -- you can use anything (or nothing) there. To just concat the fields do field1.field2

View solution in original post

ftk
Motivator

You could concatenate the fields together:

your search | eval new_field = field1."-".field2

"-" in this example is a separator -- you can use anything (or nothing) there. To just concat the fields do field1.field2

ssrdc
New Member

Nice answer

0 Karma

labani
Explorer

thanks a lot. this is really useful. i've got exactly what i wanted.

0 Karma

aleem
SplunkTrust
SplunkTrust

many thanks for this tip

Be the best version of you
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...