- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
SumanPalisetty
Path Finder
10-31-2022
10:01 AM
Hi,
Can we concatenate a string with a number using eval with '.' operator? I got to know that from a video, but when i do it, I am able to do it. I don't know what is going on. Kindly help.
Regards
Suman P.
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

somesoni2
Revered Legend
10-31-2022
11:30 AM
- The plus ( + ) operator accepts two numbers for addition, or two strings for concatenation.
- The period ( . ) operator concatenates both strings and number. Numbers are concatenated in their string represented form.
Check if the field "action" has null values. If it does, whole eval expression will be null. In stead, try like this :
source= "2access_30DAY.log"
| eval "new_field"=coalesce('action',"Default String Here, change it per your need"). 10 | table "new_field"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

somesoni2
Revered Legend
10-31-2022
11:30 AM
- The plus ( + ) operator accepts two numbers for addition, or two strings for concatenation.
- The period ( . ) operator concatenates both strings and number. Numbers are concatenated in their string represented form.
Check if the field "action" has null values. If it does, whole eval expression will be null. In stead, try like this :
source= "2access_30DAY.log"
| eval "new_field"=coalesce('action',"Default String Here, change it per your need"). 10 | table "new_field"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
SumanPalisetty
Path Finder
10-31-2022
10:12 AM
Sorry, I am being stupid. '.' operator allows concatenation of numeric and alphabets while '+' allows only concatenation of alphabets and numeric.
Regards
Suman P.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
10-31-2022
10:09 AM
For some of your events the action field is null/not present
