Splunk Search

How to combine two fields into one field?

splunknewby
Path Finder

How do I combine two fields into one field? I've tried the following (http://answers.splunk.com/answers/8334/help-with-combining-fields.html) options, but the:

eval IP = src_ip." / ".dst_ip

However, this does not result in a new IP field in my searches.

0 Karma
1 Solution

MuS
Legend

Hi splunknewby,

this works perfect with this example:

| gentimes start=-1 | eval src_ip="1.1.1.1" | eval dst_ip="2.2.2.2" | eval IP = src_ip." / ".dst_ip

Do you get src_ip or dst_ip fields in your events? Because this will only work if you get those fields in the search result.

cheers, MuS

View solution in original post

aljohnson_splun
Splunk Employee
Splunk Employee

are you maybe looking to make the values for each field accessible under one field's name ?

... | eval combined_ip = coalesce(src_ip, dst_ip)

woodcock
Esteemed Legend

Some fields may not always have a value so try this:

...  | fillnull src_ip dst_ip | eval IP = src_ip . " /  ". dst_ip

MuS
Legend

Hi splunknewby,

this works perfect with this example:

| gentimes start=-1 | eval src_ip="1.1.1.1" | eval dst_ip="2.2.2.2" | eval IP = src_ip." / ".dst_ip

Do you get src_ip or dst_ip fields in your events? Because this will only work if you get those fields in the search result.

cheers, MuS

splunknewby
Path Finder

Thanks MuS.

0 Karma

MuS
Legend

You're welcome 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...