Splunk Search

How to combine two field values into one

skodak
Explorer

I have got a query like this

 

index=* request in (request1, request2, request3)

eval  request&& = request1 + request2

Please help. 

Labels (3)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

Based on your query I understand that request1,request2,request3 are values of request. 
eval you are adding request1,request2 you will get empty because you don’t have those fields.

 

share sample event and explain your question clearly.

————————————
If this helps, give a like below.
0 Karma

skodak
Explorer

Looks like I got the solution.  I have used MATCH  to solve it.

Thank you @thambisetty 

thambisetty
SplunkTrust
SplunkTrust

Accept my answer as solution if you think my answer Solved your problem.

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...