- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Everyone,
I have a file containing Account ="xxx/\xxx/\xxx/\xx"
value and this needs to be concatenated with a string, say "my account" .
when i tried following search:
index=myindex | eval description= "my account" + Account | table description
getting blank for "description" .
Can any one guide me where aI'm going wrong ??? or this is because of the "/\" character in the string?
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello All,
Thanks for your reply, the problem was Account string contain the two values with line break. so i used mvjoin
command to remove line and now it is working perfectly fine.
Once again thanks all !!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello All,
Thanks for your reply, the problem was Account string contain the two values with line break. so i used mvjoin
command to remove line and now it is working perfectly fine.
Once again thanks all !!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do the quote characters show up in the Account field? If so I wonder if that is throwing it off. Maybe try the following before your eval
... | rex field=Account "\"(?<Account>[^\"]+)" | ...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

I don't think the characters will matter.
To prove this, try replacing them with something else?
index=myindex | eval rfield=REPLACE(Account, "/", "-") | eval description="my account" + rfield | table description
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for reply @kendrickt.. same not getting display !!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

use .
index=myindex | eval description= "my account".Account | table description
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for reply @mzorzi. but it is not working.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you paste what the output of the below code looks like?
I did a quick test of the code above and it seems to work fine
index=myindex | table Account
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for reply @ramdaspr. the problem was this string it contain line break, so it was not coming. i used "mvjoin" command for removing line. that it worked !!! 🙂
