Splunk Search

How to combine two field values into one

skodak
Explorer

I have got a query like this

 

index=* request in (request1, request2, request3)

eval  request&& = request1 + request2

Please help. 

Labels (3)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

Based on your query I understand that request1,request2,request3 are values of request. 
eval you are adding request1,request2 you will get empty because you don’t have those fields.

 

share sample event and explain your question clearly.

————————————
If this helps, give a like below.
0 Karma

skodak
Explorer

Looks like I got the solution.  I have used MATCH  to solve it.

Thank you @thambisetty 

thambisetty
SplunkTrust
SplunkTrust

Accept my answer as solution if you think my answer Solved your problem.

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...