How to merge several fields from a log to one field?

[ljxdennis]

Hi guys,

i am pretty new to Splunk and i have the following Task.
I have four Systems with logs. I want to merge several fields from a log from one system to one field to generate a X-Trace-ID. I Need this X-Trace-ID to track the Transaction over the four Systems away.
Actually i could use the method of expanding the database of each Systems concerning one column and add an X-Trace-ID but we can't do that because of cost Problems.
Could you help me how can i generate in an alternative way a X-Trace-ID accross System boundaries?

Thank you very much and i am looking Forward for some answers.

Greetings

Dennis

[kmorris_splunk · Accepted solution]

Assuming I am understanding your request correctly, it sounds like you want to create a new field made up of a concatenation of other fields in the same event. If this is correct, try something like this:

<YOUR BASE SEARCH>
| eval X-Trace-ID=field1 . "-" . field2 . "-" field3 . "-" . field4

Not sure if you wanted the values separated or not, so I added the "-" between fields.

[ljxdennis]

Thank you much! 🙂