Combine a numerical field with a string field separated with a dash

[subhrangshu]

Hello,

I am trying to combine couple of fields data separated by a dash. Tried few options but could not get the expected output.

My query is:

index=test sourcetype="test-abc"  ("enter start()")
| rename job_id as JOB_ID
| stats earliest(_time) AS Earliest by JOB_ID
| eval FirstEvent=strftime(Earliest,"%b %d, %Y %H:%M:%S")
| eval JOB_ID_STR=tostring(JOB_ID)
| eval JOB-ID-WITH-TIME=printf("%s%z", JOB_ID_STR,FirstEvent)

In the above query: JOB_ID is a numerical data of length 4 digit. FirstEvent is string of time format of that event.

Ex:

JOB_ID = 9000 and FirstEvent = Jul 07, 2020 04:56:43

Using the above query and with printf function,  JOB-ID-WITH-TIME is returned as 9000Jul 07, 2020 04:56:43. 

I want the output to be like 9000-Jul 07, 2020 04:56:43 (a dash between JOB_ID and FirstEvent).

How to do it?

Thanks in advance for your time!

[diogofgm · Accepted solution]

You can just use eval for that:

JOB_ID = 9000 and FirstEvent = Jul 07, 2020 04:56:43

| eval job_with_time = JOB_ID + "-" + FirstEvent

[subhrangshu]

Thanks for the prompt reply. I don't know, how I missed this. Thanks again 😃