Splunk Search

How to table out two string fields under one field/column?

FaridHamidi
Engager

 

 

| eval Alert_Message_DISK = status_disk.": Disk utilization for ".host." is ".total_disk_utilization."%"
| eval Alert_Message_DISKD = status_diskD.": Disk utilization for ".host." is ".disk_D."%"
| table Alert_Message

 

 


I want to put these two string fields created using "eval" under one "Alert_Message". thank you.

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You mean like this?

| eval Alert_Message=mvappend(Alert_Message_DISK,Alert_Message_DISKD)
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...