Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to combine two fields into one field?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How do I combine two fields into one field? I've tried the following (http://answers.splunk.com/answers/8334/help-with-combining-fields.html) options, but the:
eval IP = src_ip." / ".dst_ip
However, this does not result in a new IP field in my searches.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi splunknewby,
this works perfect with this example:
| gentimes start=-1 | eval src_ip="1.1.1.1" | eval dst_ip="2.2.2.2" | eval IP = src_ip." / ".dst_ip
Do you get src_ip or dst_ip fields in your events? Because this will only work if you get those fields in the search result.
cheers, MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
are you maybe looking to make the values for each field accessible under one field's name ?
... | eval combined_ip = coalesce(src_ip, dst_ip)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Some fields may not always have a value so try this:
... | fillnull src_ip dst_ip | eval IP = src_ip . " / ". dst_ip
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi splunknewby,
this works perfect with this example:
| gentimes start=-1 | eval src_ip="1.1.1.1" | eval dst_ip="2.2.2.2" | eval IP = src_ip." / ".dst_ip
Do you get src_ip or dst_ip fields in your events? Because this will only work if you get those fields in the search result.
cheers, MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks MuS.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You're welcome 🙂
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
