Splunk Search

How to join different fields together?

jhilton90
Path Finder

I have an index called index=advanced_hunting and in this index there is a field called category, where there are several categories like 

AdvancedHunting-DeviceFileEvents

AdvancedHunting-DeviceNetworkEvents etc

I'm trying to look into the AdvancedHunting-DeviceFileEvents category to look at what files have been deleted, but the logs in that specific category don't feature the properties.AccountName i.e. the person, it does however, have a filed called properties.DeviceName.

However, the category of AdvancedHunting-DeviceLogonEvents does have a field called properties.AccountName, as well as properties.DeviceName.

So I was wondering if it's possible to connect the properties.AccountName and properties.DeviceName together so I can see who has deleted something

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @jhilton90,

in Splunk it's possible to join two fields using eval command:

| eval new_field='properties.AccountName'."-".'properties.DeviceName'

there could be an issue related to the dot in the field name, so please try this:

| rename properties.AccountName AS AccountName properties.DeviceName AS DeviceName
| eval new_field=AccountName."-".DeviceName

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jhilton90,

in Splunk it's possible to join two fields using eval command:

| eval new_field='properties.AccountName'."-".'properties.DeviceName'

there could be an issue related to the dot in the field name, so please try this:

| rename properties.AccountName AS AccountName properties.DeviceName AS DeviceName
| eval new_field=AccountName."-".DeviceName

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jhilton90 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

Enterprise Security Content Update (ESCU) | New Releases

In April, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...