In a search combine two-three field values(columns) into one field

[man03359]

Hi,

I have an output like this -

Location	EventName	ErrorCode	Summary
server1	Mssql.LogBackupFailed	BackupAgentError	Failed backup....
server2	Mssql.LogBackupFailed	BackupAgentError	Failed backup....

Now I am trying to combine all the values of Location, EventName, ErrorCode and Summary into one field called "newfield" , lets say using a comma "," or ";"

I am trying this command -

| eval newfield= mvappend(LocationName,EventName,ErrorCode,summary)

but the output it is giving is -  

server1

Mssql.LogBackupFailed

BackupAgentError

Failed backup....

Output I am expecting is -

server1,Mssql.LogBackupFailed,BackupAgentError,Failed backup

[ITWhisperer]

| eval newfield= mvjoin(mvappend(LocationName,EventName,ErrorCode,summary),",")

[gcusello]

Hi @man03359 ,

if you want the values of the fields separated by comma, you should use eval in this way:

| eval newfield=LocationName.",".EventName.",".ErrorCode.",".summary

Ciao.

Giuseppe