Splunk Search

How to concatenate fields?

uagraw01
Motivator

Hello Splunkers!!

 

I have two fields AND I want to concatenate both the fields.

Location : 3102.01.03

element : S82(=3102+LCC60-550S5)

And I want a result : 3102.01.03.S82(=3102+LCC60-550S5)

 

I have tried Location.".".element but it is not working properly. Please suggest me a fic workaround.

 

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Not sure it is "not working"

| makeresults
| eval Location="3102.01.03"
| eval element="82(=3102+LCC60-550S5)"
| eval field=Location.".".element

Can you provide more details of how it isn't working?

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

It should work this way.

See the run-anywhere example

| makeresults 
| eval a="a", b="b", c=a.".".b

For future reference:

1) Please set the subject of your post to something more descriptive than just "SPL". You're posting in the Splunk Search section, we get that you probably need help with some SPL

2) Be more descriptive than "is not working". What do you mean by that? You get any error? You get blank result? You get just one field and not the other?

uagraw01
Motivator

@PickleRick Thanks for your support, its working fine now.

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Not sure it is "not working"

| makeresults
| eval Location="3102.01.03"
| eval element="82(=3102+LCC60-550S5)"
| eval field=Location.".".element

Can you provide more details of how it isn't working?

uagraw01
Motivator

@ITWhisperer Its working fine as same as I already tried but now its working.

 

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...