Splunk Search

How to join different fields together?

jhilton90
Path Finder

I have an index called index=advanced_hunting and in this index there is a field called category, where there are several categories like 

AdvancedHunting-DeviceFileEvents

AdvancedHunting-DeviceNetworkEvents etc

I'm trying to look into the AdvancedHunting-DeviceFileEvents category to look at what files have been deleted, but the logs in that specific category don't feature the properties.AccountName i.e. the person, it does however, have a filed called properties.DeviceName.

However, the category of AdvancedHunting-DeviceLogonEvents does have a field called properties.AccountName, as well as properties.DeviceName.

So I was wondering if it's possible to connect the properties.AccountName and properties.DeviceName together so I can see who has deleted something

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @jhilton90,

in Splunk it's possible to join two fields using eval command:

| eval new_field='properties.AccountName'."-".'properties.DeviceName'

there could be an issue related to the dot in the field name, so please try this:

| rename properties.AccountName AS AccountName properties.DeviceName AS DeviceName
| eval new_field=AccountName."-".DeviceName

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jhilton90,

in Splunk it's possible to join two fields using eval command:

| eval new_field='properties.AccountName'."-".'properties.DeviceName'

there could be an issue related to the dot in the field name, so please try this:

| rename properties.AccountName AS AccountName properties.DeviceName AS DeviceName
| eval new_field=AccountName."-".DeviceName

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jhilton90 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...