How to concatenate strings with special characters... - Splunk Community

Splunk Search

Hi,

How can I concatenate Start time and duration in below format. Right now I am using this, but it is only half working.

... | eval newField= Start_time."".duration

Desired format : 01:40[20m]

You just need spacing, like this:

...| eval newField = Start_time . "[" . duration . "]"

Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious! We’re back with this month’s ...