Splunk Search

Is it possible to concatenate string with a number using eval?

SumanPalisetty
Path Finder

Hi,

Can we concatenate a string with a number using eval with '.' operator? I got to know that from a video, but when i do it, I am able to do it. I don't know what is going on. Kindly help.

eval1.png

Regards

Suman P.

Labels (1)
Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend
  • The plus ( + ) operator accepts two numbers for addition, or two strings for concatenation.
  • The period ( . ) operator concatenates both strings and number. Numbers are concatenated in their string represented form.

Check if the field "action" has null values. If it does, whole eval expression will be null. In stead, try like this :

 

 

source= "2access_30DAY.log"
| eval "new_field"=coalesce('action',"Default String Here, change it per your need"). 10 | table "new_field"

 

  

View solution in original post

somesoni2
Revered Legend
  • The plus ( + ) operator accepts two numbers for addition, or two strings for concatenation.
  • The period ( . ) operator concatenates both strings and number. Numbers are concatenated in their string represented form.

Check if the field "action" has null values. If it does, whole eval expression will be null. In stead, try like this :

 

 

source= "2access_30DAY.log"
| eval "new_field"=coalesce('action',"Default String Here, change it per your need"). 10 | table "new_field"

 

  

SumanPalisetty
Path Finder

Sorry, I am being stupid. '.' operator allows concatenation of numeric and alphabets while '+' allows only concatenation of alphabets and numeric.

Regards

Suman P.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

For some of your events the action field is null/not present

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...