Splunk Search

## Combining unique field values

Path Finder

I have the following problem I would like to solve

Numbers1 Numbers 2
1 6
2 7
3 8
4 9
5 10

I want to concatenate so it will be like this
Number_combined
1
2
3
4
5
6
7
8
9
10

I have tried field aliases, mvjoin, coalescence, eval with the (.) but still can't seem to figure it out.

Thanks,

Tags (4)
1 Solution
Path Finder

So I was able to solve it with the help of a good friend. I used |makeresults command to just test it.

| makeresults
| eval numbers=random()
| eval numbers2=random()
| eval numbers3=random()
| fillnull value="" numbers numbers2 numbers3
| eval test=numbers.".".numbers2.".".numbers3
| eval testing=split(test,".")

I used the random() function to just generate some random numbers

So imagine numbers 1=123
So imagine numbers 2=456
So imagine numbers 3=789

fillnull fills in the values from the fields we are using
we eval to basically combine the fields
then finally we split by the delimiter/separator(in this case ".") we used in our previous eval

I hope I explained this well.

Path Finder

So I was able to solve it with the help of a good friend. I used |makeresults command to just test it.

| makeresults
| eval numbers=random()
| eval numbers2=random()
| eval numbers3=random()
| fillnull value="" numbers numbers2 numbers3
| eval test=numbers.".".numbers2.".".numbers3
| eval testing=split(test,".")

I used the random() function to just generate some random numbers

So imagine numbers 1=123
So imagine numbers 2=456
So imagine numbers 3=789

fillnull fills in the values from the fields we are using
we eval to basically combine the fields
then finally we split by the delimiter/separator(in this case ".") we used in our previous eval

I hope I explained this well.

Builder

Hello sahr

Kindly check this similar question.

Hope it helps!

Thanks!

Path Finder

Thanks a lot @lloydknight. I was able to figure it out using the same concept. I just missed a couple of steps.

Thanks,
Sahr

Get Updates on the Splunk Community!

#### Discover SplunkTrust and MVP Articles, Instant Translation, and More on Splunk ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

#### Integrating Kubernetes and Splunk Observability Cloud

We need end-to-end insight into our application environments to confidently ensure everything is up and ...

#### Index This | What has a tail and a head but no body?

July 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...