Splunk Search

Consolidate fields at search time

Josh
Path Finder

How can I consolidate 2 or more fields into one new field at search time?

e.g. ...| fields a,b,c | d

In the above I would like d to hold all values in fields a,b,c so what I am doing is creating a new field called d out of the fields a,b and c. Is this possible?

Tags (1)
0 Karma
2 Solutions

Lowell
Super Champion

If you want them all concatenated, then you can do:

eval d=a.b.c

If you want a multi-value field, you could do something like this (assuming that you don't have ; in your values to begin with):

eval d=split(a . ";" . b . ";" . c, ";")

If you are trying to get a single value when a, b, or c could be null (or missing), then you can use:

eval d=coalesce(a,b,c)

Are any of these what you are looking for?

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

Also, if you want to create a single multi-valued field, you would concatenate the values with a delimiter as in one of the other answers, and then use the | makemv command.

View solution in original post

sideview
SplunkTrust
SplunkTrust

If your intention ultimately is to get statistics or data about each unique combination of a, b and c, then its easier to do things like "stats avg(foo) values(bar) by a, b, c".

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Also, if you want to create a single multi-valued field, you would concatenate the values with a delimiter as in one of the other answers, and then use the | makemv command.

gkanapathy
Splunk Employee
Splunk Employee

No, it's the same.

0 Karma

Lowell
Super Champion

Is there an advantage to using makemv vs using split() eval function? (Other than split() was introduced in 4.1)

0 Karma

Simeon
Splunk Employee
Splunk Employee

Eval command could do this:

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Eval

... | eval field_d=field_a+field_b+field_c | fields field_d

Also, the nomv command might be helpful for your use case:

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Nomv

0 Karma

Lowell
Super Champion

If you want them all concatenated, then you can do:

eval d=a.b.c

If you want a multi-value field, you could do something like this (assuming that you don't have ; in your values to begin with):

eval d=split(a . ";" . b . ";" . c, ";")

If you are trying to get a single value when a, b, or c could be null (or missing), then you can use:

eval d=coalesce(a,b,c)

Are any of these what you are looking for?

Josh
Path Finder

eval d=coalesce(a,b,c)

This worked a treat, single value when a,b or c wcould be null (or missing)

Perfect thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...