Splunk Search

How to combine multiple fields?

zkenaga
New Member

I have multiple fields with the name name_zz_(more after this)

How would I be able to merge all of the like tests into one field?

Tags (3)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

You want to merge values (concatenate values) OR each event will have single field but different name but you want to create a common name field?

0 Karma

zkenaga
New Member

I am looking to join all the names together and have them report as one name.

0 Karma

zkenaga
New Member

right now I have

name_zz_1
name_zz_2
name_zz_3

I would like to have those combined to just report as name_zz

0 Karma

somesoni2
SplunkTrust
SplunkTrust

So basically, right now you've to do like this to see all values?

...some search | table ..some fields.. name_zz_1 name_zz_2 name_zz_3

and you want to do like

...some search | table ..some fields.. name_zz

Where name_zz will contain values of all 3 (or any number of fields) name_zz_N fields?

It's generally easier for us if you can post some sample values and corresponding expected output.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

If its the first case (multiple fields to be combined into one), try this

...some search.. | eval name_zz="" | foreach name_zz_* [| eval name_zz=coalesce('<<FIELD>>'.",","").name_zz] | fields - name_zz_*
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...