Splunk Search

How to combine two field values into one

skodak
Explorer

I have got a query like this

 

index=* request in (request1, request2, request3)

eval  request&& = request1 + request2

Please help. 

Labels (3)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

Based on your query I understand that request1,request2,request3 are values of request. 
eval you are adding request1,request2 you will get empty because you don’t have those fields.

 

share sample event and explain your question clearly.

————————————
If this helps, give a like below.
0 Karma

skodak
Explorer

Looks like I got the solution.  I have used MATCH  to solve it.

Thank you @thambisetty 

thambisetty
SplunkTrust
SplunkTrust

Accept my answer as solution if you think my answer Solved your problem.

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

  Ready to master Kubernetes and cloud monitoring like the pros?Join Splunk’s Growth Engineering team for an ...

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...