How to create common name for 3 different fields in an event?

[Navanitha]

I have event like below and I am trying to create a common field for  CI_Name / Hostname /IP_Address and name it as Generic_HostName.

2023-06-21 07:46:38.701, CI_Name="abc.xyz.net", Hostname="abc", Domain="xyz.net", System_Role="DR", Environment="DR", IP_Address="40.90.20.10", Tier1="Hosting", Tier2="Processing unit", Tier3="Server", BU="poc", Operating_System="Red Hat Enterprise Linux 7.9", OS_Version="7.9",

So when I do a stats on Generic_Hostname, the result should have CI_Name, Hostname, IP_Address.

index=* | stats count by Generic_Hostname

Output:

abc.xyz.net

abc

40.90.20.10

How can I achieve this?  

[yuanliu · Accepted solution]

The command you are looking for is mvappend.

Generic_Hostname = mvappend(CI_Name, Hostname, IP_Address)

Hope this helps.

[Navanitha]

Thank you @yuanliu.  This is exactly what I was looking for.