Splunk Search

How to combine two field values into one

skodak
Explorer

I have got a query like this

 

index=* request in (request1, request2, request3)

eval  request&& = request1 + request2

Please help. 

Labels (3)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

Based on your query I understand that request1,request2,request3 are values of request. 
eval you are adding request1,request2 you will get empty because you don’t have those fields.

 

share sample event and explain your question clearly.

————————————
If this helps, give a like below.
0 Karma

skodak
Explorer

Looks like I got the solution.  I have used MATCH  to solve it.

Thank you @thambisetty 

thambisetty
SplunkTrust
SplunkTrust

Accept my answer as solution if you think my answer Solved your problem.

————————————
If this helps, give a like below.
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...