Splunk Search

How to combine two fields into one field?

splunknewby
Path Finder

How do I combine two fields into one field? I've tried the following (http://answers.splunk.com/answers/8334/help-with-combining-fields.html) options, but the:

eval IP = src_ip." / ".dst_ip

However, this does not result in a new IP field in my searches.

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi splunknewby,

this works perfect with this example:

| gentimes start=-1 | eval src_ip="1.1.1.1" | eval dst_ip="2.2.2.2" | eval IP = src_ip." / ".dst_ip

Do you get src_ip or dst_ip fields in your events? Because this will only work if you get those fields in the search result.

cheers, MuS

View solution in original post

aljohnson_splun
Splunk Employee
Splunk Employee

are you maybe looking to make the values for each field accessible under one field's name ?

... | eval combined_ip = coalesce(src_ip, dst_ip)

woodcock
Esteemed Legend

Some fields may not always have a value so try this:

...  | fillnull src_ip dst_ip | eval IP = src_ip . " /  ". dst_ip

MuS
SplunkTrust
SplunkTrust

Hi splunknewby,

this works perfect with this example:

| gentimes start=-1 | eval src_ip="1.1.1.1" | eval dst_ip="2.2.2.2" | eval IP = src_ip." / ".dst_ip

Do you get src_ip or dst_ip fields in your events? Because this will only work if you get those fields in the search result.

cheers, MuS

splunknewby
Path Finder

Thanks MuS.

0 Karma

MuS
SplunkTrust
SplunkTrust

You're welcome 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...