Splunk Search

How can I create a third field based on unique combinations of two other fields

cmontonen
Explorer

Hello all,
I am really new to Splunk and cannot for the life of me figure this one out.
Unfortunately, Googling around for answers has not been helpful.

I have records which contain two important fields initiator_country and responder_country.
I am interested in observing records with rare combinations of the two fields.
There are 3 possible values for initiator_country and responder_country, so 9 total combinations.
I would like to create a 3rd field for each record indicating which initiator_country - responder_country
combination the record belongs to, but I am not really sure where I should start.

Thank you very much!

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

Is this what you mean?

... | eval newField = initiator_country . "-" . responder_country

View solution in original post

woodcock
Esteemed Legend

Is this what you mean?

... | eval newField = initiator_country . "-" . responder_country

cmontonen
Explorer

Wow! Thank you very much!
I just tested it and it worked!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...