Splunk Search

Is it possible to concatenate string with a number using eval?

SumanPalisetty
Path Finder

Hi,

Can we concatenate a string with a number using eval with '.' operator? I got to know that from a video, but when i do it, I am able to do it. I don't know what is going on. Kindly help.

eval1.png

Regards

Suman P.

Labels (1)
Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend
  • The plus ( + ) operator accepts two numbers for addition, or two strings for concatenation.
  • The period ( . ) operator concatenates both strings and number. Numbers are concatenated in their string represented form.

Check if the field "action" has null values. If it does, whole eval expression will be null. In stead, try like this :

 

 

source= "2access_30DAY.log"
| eval "new_field"=coalesce('action',"Default String Here, change it per your need"). 10 | table "new_field"

 

  

View solution in original post

somesoni2
Revered Legend
  • The plus ( + ) operator accepts two numbers for addition, or two strings for concatenation.
  • The period ( . ) operator concatenates both strings and number. Numbers are concatenated in their string represented form.

Check if the field "action" has null values. If it does, whole eval expression will be null. In stead, try like this :

 

 

source= "2access_30DAY.log"
| eval "new_field"=coalesce('action',"Default String Here, change it per your need"). 10 | table "new_field"

 

  

SumanPalisetty
Path Finder

Sorry, I am being stupid. '.' operator allows concatenation of numeric and alphabets while '+' allows only concatenation of alphabets and numeric.

Regards

Suman P.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

For some of your events the action field is null/not present

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...