How to consolidate values from 2 fields in my data into a new field?

[bugnet]

Hi all,

There is a way to consolidate two fields?
For example, I have the following event:

"CEF:0|IMPERVA|SecureSphere|9.0.0|Firewall: eventID=233215 act=none proto=tcp cs1=mozilla cs1lable=firefox"

The meaning of cs1 is = Custom string1

I want to consolidate the fields cs1=mozilla and cs1lable=firefox to a new field . for example: User-Agent=mozilla_firefox
And If it possible to set it globally.

???

10x

[stephanefotso]

First extract fields before the concatenation:

...|rex field=_raw "cs1\=(?<field1>\S)\s+cs1lable\=(?<field2>[^\n])"|eval user_agent=field1+"_"+field2|table user_agent

[stephane_cyrill]

Hi Bugnet, i hope what you want is a concatenation. if yes try this:

... | strcat cs1 "_" cs1lable User-Agent

doing so will give you the expected result if your fields cs1 and cs1lable are extracted fields