Splunk Search

How to combine two field values into one

skodak
Explorer

I have got a query like this

 

index=* request in (request1, request2, request3)

eval  request&& = request1 + request2

Please help. 

Labels (3)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

Based on your query I understand that request1,request2,request3 are values of request. 
eval you are adding request1,request2 you will get empty because you don’t have those fields.

 

share sample event and explain your question clearly.

————————————
If this helps, give a like below.
0 Karma

skodak
Explorer

Looks like I got the solution.  I have used MATCH  to solve it.

Thank you @thambisetty 

thambisetty
SplunkTrust
SplunkTrust

Accept my answer as solution if you think my answer Solved your problem.

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...