Splunk Search

Help with concatenation needed

damucka
Builder

Hello,

I need to concatenate two variables including strings (e-mail lists) into one.
the code I use for that is the following:

index=mlbso_changelog  sourcetype="*_crashdumps" crash_context OR crash_stack OR crash_shortinfo NOT "table of contents"| reverse
| rex field=source "\/.+_(?P<DBSID>.+)\/(?P<service>.+)\_(?<filenameend>.+)$" 
| eval filename = service."_".filenameend 
| eval PRIO = "P1"
| lookup email_groups.csv DBSID OUTPUT email_recipients_DBSID AS email_recipients_DBSID
| lookup email_groups_critical_alerts.csv "PRIO" OUTPUT email_recipients_critical_alerts AS email_recipients_critical_alerts
| eval email_recipients=email_recipients_critical_alerts+";"+email_recipients_DBSID

So, it all seems to be quite straightforward. However when one of the components is empty (email_recipients_critical_alerts or email_recipients_DBSID) then also the result - email_recipients does not get set. Actually I would expect from the concatenation to set it at least to the other component.
Could you please advise?

Kind Regards,
Kamil

Tags (1)
0 Karma
1 Solution

damucka
Builder

found an answer in another question:

| strcat email_recipients_critical_alerts ";" email_recipients_DBSID email_recipients

Regards,
Kamil

View solution in original post

0 Karma

damucka
Builder

found an answer in another question:

| strcat email_recipients_critical_alerts ";" email_recipients_DBSID email_recipients

Regards,
Kamil

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...