Splunk Search

Help with concatenation needed

damucka
Builder

Hello,

I need to concatenate two variables including strings (e-mail lists) into one.
the code I use for that is the following:

index=mlbso_changelog  sourcetype="*_crashdumps" crash_context OR crash_stack OR crash_shortinfo NOT "table of contents"| reverse
| rex field=source "\/.+_(?P<DBSID>.+)\/(?P<service>.+)\_(?<filenameend>.+)$" 
| eval filename = service."_".filenameend 
| eval PRIO = "P1"
| lookup email_groups.csv DBSID OUTPUT email_recipients_DBSID AS email_recipients_DBSID
| lookup email_groups_critical_alerts.csv "PRIO" OUTPUT email_recipients_critical_alerts AS email_recipients_critical_alerts
| eval email_recipients=email_recipients_critical_alerts+";"+email_recipients_DBSID

So, it all seems to be quite straightforward. However when one of the components is empty (email_recipients_critical_alerts or email_recipients_DBSID) then also the result - email_recipients does not get set. Actually I would expect from the concatenation to set it at least to the other component.
Could you please advise?

Kind Regards,
Kamil

Tags (1)
0 Karma
1 Solution

damucka
Builder

found an answer in another question:

| strcat email_recipients_critical_alerts ";" email_recipients_DBSID email_recipients

Regards,
Kamil

View solution in original post

0 Karma

damucka
Builder

found an answer in another question:

| strcat email_recipients_critical_alerts ";" email_recipients_DBSID email_recipients

Regards,
Kamil

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...