Splunk Search

Combine 2 fields to create a new field?

Champion

I have a search that generates a list of IP addresses and usernames by time. I'd like to dedup the value of ip address + username. I cannot dedup just one (ip OR username) because the IP addresses get recycled and will get reassigned to another user.

Is it possible to combine my 2 fields (ip_address + username) to create a 3rd field that I can use for dedup purposes?

Tags (1)
1 Solution

Motivator

You could concatenate the fields together:

your search | eval new_field = field1."-".field2

"-" in this example is a separator -- you can use anything (or nothing) there. To just concat the fields do field1.field2

View solution in original post

Motivator

You could concatenate the fields together:

your search | eval new_field = field1."-".field2

"-" in this example is a separator -- you can use anything (or nothing) there. To just concat the fields do field1.field2

View solution in original post

New Member

Nice answer

0 Karma

Explorer

thanks a lot. this is really useful. i've got exactly what i wanted.

0 Karma

SplunkTrust
SplunkTrust

many thanks for this tip

0 Karma