Splunk Search

Combine Dynamic Fields Starting with same value

DanielWick
New Member

So I have multiple fields whose field names could end with a different values. Examples of these fields are below:
foo.foo_a = 1
foo.foo_b = 2
foo.foo_123 = null
foo.foo_test = 4

What I want to do is combine all of these values into a single value.
Essentially, I want a new value like below
new_value= foo.foo_*
where new_value would then be equal to:
1
2
4

If anybody could help guide me on this, it would be greatly appreciated.

I was hoping that something like
stats list(foo.foo_*) by field
would have worked, but it doesn't provide the output that I am looking for, which is all of the fields combined into one.

0 Karma

somesoni2
Revered Legend

Give this a try. It , combines all foo.foo_* field values, concatenated by space, into field foo. If you want different delimiter, just update the 2nd expression in foreach-eval.

your current search with all foo.foo_* fields
| eval foo="" 
| foreach foo.foo_* [ eval foo=if(foo="",'<<FIELD>>',foo." ".'<<FIELD>>']
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...