How to display two field values in a single table column?

[JohnSwansson]

I have the following search:

index=cashflow host=atm source=income OR source=outcome | eval accountStatus="Income: " + transactionIncome + " and Outcome: " + transactionOutcome | table accountStatus

I have validated that | table transactionIncome transactionOutcome works, meaning that I see the values of each field in separate columns, but it does not work combining them in a single column called accountStatus as the query would. Why is this? I am also not able to do a column with the sum of [ transactionIncome + transactionOutcome ]. What have I not understood?

EDIT: Okay so apparently you can't add the value of a field from one event with the value of a field in another event. How would one go about this? transactionIncome and transactionOutcome are generated from different sources and are not within the same event.

[somesoni2]

If you query gives you only two events, one with transactionIncome and other with transactionOutcome, then try something like this

index=cashflow host=atm source=income OR source=outcome | stats values(transactionIncome) as transactionIncome values(transactionOutcome) as transactionOutcome by host | eval accountStatus="Income: " + transactionIncome + " and Outcome: " + transactionOutcome | table accountStatus

Update
Try this

 index=cashflow host=atm source=income OR source=outcome | eval transactionIncome=coalesce(transactionIncome,null()) | eval transactionOutcome=coalesce(transactionOutcome,null())| stats values(transactionIncome) as transactionIncome values(transactionOutcome) as transactionOutcome by host | eval accountStatus="Income: " + transactionIncome + " and Outcome: " + transactionOutcome | table accountStatus

[JohnSwansson]

Sorry, no, same result as before. It works only with transactionIncome or transactionOutcome, never both at the same time...

[somesoni2]

Do you have any common field/value that can be used to combine two events?? OR if they always appear in a particular order which can be used?

[JohnSwansson]

They both share the same host!

[pradeepkumarg]

Concatenation operator between two strings in splunk is . and not +

 index=cashflow host=atm source=income OR source=outcome | eval accountStatus="Income: ".transactionIncome." and Outcome: ".transactionOutcome | table accountStatus

[JohnSwansson]

Still doesn't work, when running eval accountStatus="Income: ".transactionIncome." and Outcome: ".transactionOutcome i get:

Nothing. accountStatus is empty.

When running: eval accountStatus="Income: ".transactionIncome I get:

Income: 100

When running eval accountStatus=" and Outcome: ".transactionOutcome I get:

and Outcome: 200

... but within the same row and within the same "string of text" it will not show up.

[krishnarajapant]

Hi,

You can add the columns using "addcoltotals" and "addtotals" commands.

Also I tried with below and it is working fine for me. In my example code and bytes are two different fields.

sourcetype=* | eval x= code + bytes | table code bytes x | fieldformat x= "Total:".x

-Krishna Rajapantula