Splunk Search

How to concatenate a string with a value containing special characters?

snehal8
Path Finder

Hello Everyone,

I have a file containing Account ="xxx/\xxx/\xxx/\xx" value and this needs to be concatenated with a string, say "my account" .

when i tried following search:

index=myindex  | eval description= "my account" + Account | table description

getting blank for "description" .

Can any one guide me where aI'm going wrong ??? or this is because of the "/\" character in the string?

Thanks

0 Karma
1 Solution

snehal8
Path Finder

Hello All,

Thanks for your reply, the problem was Account string contain the two values with line break. so i used mvjoin command to remove line and now it is working perfectly fine.

Once again thanks all !!

View solution in original post

0 Karma

snehal8
Path Finder

Hello All,

Thanks for your reply, the problem was Account string contain the two values with line break. so i used mvjoin command to remove line and now it is working perfectly fine.

Once again thanks all !!

0 Karma

Runals
Motivator

Do the quote characters show up in the Account field? If so I wonder if that is throwing it off. Maybe try the following before your eval

... | rex field=Account "\"(?<Account>[^\"]+)" | ...
0 Karma

kendrickt
Path Finder

I don't think the characters will matter.

To prove this, try replacing them with something else?

index=myindex | eval rfield=REPLACE(Account, "/", "-") | eval description="my account" + rfield | table description
0 Karma

snehal8
Path Finder

Thanks for reply @kendrickt.. same not getting display !!!

0 Karma

mzorzi
Splunk Employee
Splunk Employee

use .

index=myindex | eval description= "my account".Account | table description

0 Karma

snehal8
Path Finder

Thanks for reply @mzorzi. but it is not working.

0 Karma

ramdaspr
Contributor

Can you paste what the output of the below code looks like?
I did a quick test of the code above and it seems to work fine

index=myindex | table Account

0 Karma

snehal8
Path Finder

Thanks for reply @ramdaspr. the problem was this string it contain line break, so it was not coming. i used "mvjoin" command for removing line. that it worked !!! 🙂

0 Karma
Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...