Concatenate fields into a single string

[efelder0]

I have four fields: Signature_Name, Vendor_Signature, Incident_Detail_URL, Analyst_Assessment that I need to concatenate into one field (single string) called 'Event Detail'. Additionally, I need to append a semi-colon at the end of each field. How can this be done?

[cmerriman]

for the issue with MV fields and concatenation, you can always use mvjoin first to get all of the Signature Names comma separated (or any other delim)

sourcetype="incident"| sort +Severity | lookup geoip clientip as SourceIP_Address| lookup subnetlookup ip as SourceIP_Address OUTPUT subnet_name AS location | eval
client_country=replace(client_country," ","") | strcat client_city ", " client_region " " client_country mylocation | eval final_location=if(mylocation==", ",location,mylocation) | rex field=final_location "(?.) (?.)"
| eval Signature_Name=mvjoin(Signature_Name,", ")
| eval Event_Detail=Signature_Name+ ";" +Vendor_Signature+ ";" +Incident_Detail_URL+ ";" +Analyst_Assessment | table CreateTimeStamp_GMT Data_Source Reference_Number SourceIP_Address SIP_Region SIP_Country Severity Incident_Category Incident_Classification Event_Detail | outputcsv SymantecReport.csv

[leonphelps_s]

My issue ended up being a command ordering issue. Inadvertently had the eval command before the mv

[efelder0]

OK, thanks. That was helpful. However, when I have multiple values in the Signature_Name field, I get no values when I try to concatenate into the Event_Detail field.

Here is my search string:

sourcetype="incident"| sort +Severity | lookup geoip clientip as SourceIP_Address| lookup subnetlookup ip as SourceIP_Address OUTPUT subnet_name AS location | eval
client_country=replace(client_country," ","") | strcat client_city ", " client_region " " client_country mylocation | eval final_location=if(mylocation==", ",location,mylocation) | rex field=final_location "(?.) (?.)" | eval Event_Detail=Signature_Name+ ";" +Vendor_Signature+ ";" +Incident_Detail_URL+ ";" +Analyst_Assessment | table CreateTimeStamp_GMT Data_Source Reference_Number SourceIP_Address SIP_Region SIP_Country Severity Incident_Category Incident_Classification Event_Detail | outputcsv SymantecReport.csv

[leonphelps_s]

Did you ever figure this out? "No values" when there are multiple values in the field.

[Ayn]

Use eval:

... | eval Event_Detail= Signature_Name.";".Vendor_Signature.";".Incident_Detail_URL.";".Analyst_Assessment

[bbingham]

| eval Event_Detail=Signature_Name+";"+Vendor_Signature+";"+Incident_Detail_URL+";"+Analyst_Assessment+";"