Splunk Search

Combining unique field values

sahr
Path Finder

I have the following problem I would like to solve

Numbers1 Numbers 2
1 6
2 7
3 8
4 9
5 10

I want to concatenate so it will be like this
Number_combined
1
2
3
4
5
6
7
8
9
10

I have tried field aliases, mvjoin, coalescence, eval with the (.) but still can't seem to figure it out.

Help please.

Thanks,

0 Karma
1 Solution

sahr
Path Finder

So I was able to solve it with the help of a good friend. I used |makeresults command to just test it.

| makeresults
| eval numbers=random()
| eval numbers2=random()
| eval numbers3=random()
| fillnull value="" numbers numbers2 numbers3
| eval test=numbers.".".numbers2.".".numbers3
| eval testing=split(test,".")

I used the random() function to just generate some random numbers

So imagine numbers 1=123
So imagine numbers 2=456
So imagine numbers 3=789

fillnull fills in the values from the fields we are using
we eval to basically combine the fields
then finally we split by the delimiter/separator(in this case ".") we used in our previous eval

I hope I explained this well.

View solution in original post

0 Karma

sahr
Path Finder

So I was able to solve it with the help of a good friend. I used |makeresults command to just test it.

| makeresults
| eval numbers=random()
| eval numbers2=random()
| eval numbers3=random()
| fillnull value="" numbers numbers2 numbers3
| eval test=numbers.".".numbers2.".".numbers3
| eval testing=split(test,".")

I used the random() function to just generate some random numbers

So imagine numbers 1=123
So imagine numbers 2=456
So imagine numbers 3=789

fillnull fills in the values from the fields we are using
we eval to basically combine the fields
then finally we split by the delimiter/separator(in this case ".") we used in our previous eval

I hope I explained this well.

0 Karma

lloydknight
Builder

Hello sahr

Kindly check this similar question.
https://answers.splunk.com/answers/49394/merge-two-fields-into-one-field.html

Hope it helps!

Thanks!

sahr
Path Finder

Thanks a lot @lloydknight. I was able to figure it out using the same concept. I just missed a couple of steps.

Thanks,
Sahr

0 Karma
Get Updates on the Splunk Community!

Set Up More Secure Configurations in Splunk Enterprise With Config Assist

This blog post is part 3 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...