Splunk Search

Is it possible to concatenate string with a number using eval?

SumanPalisetty
Path Finder

Hi,

Can we concatenate a string with a number using eval with '.' operator? I got to know that from a video, but when i do it, I am able to do it. I don't know what is going on. Kindly help.

eval1.png

Regards

Suman P.

Labels (1)
Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend
  • The plus ( + ) operator accepts two numbers for addition, or two strings for concatenation.
  • The period ( . ) operator concatenates both strings and number. Numbers are concatenated in their string represented form.

Check if the field "action" has null values. If it does, whole eval expression will be null. In stead, try like this :

 

 

source= "2access_30DAY.log"
| eval "new_field"=coalesce('action',"Default String Here, change it per your need"). 10 | table "new_field"

 

  

View solution in original post

somesoni2
Revered Legend
  • The plus ( + ) operator accepts two numbers for addition, or two strings for concatenation.
  • The period ( . ) operator concatenates both strings and number. Numbers are concatenated in their string represented form.

Check if the field "action" has null values. If it does, whole eval expression will be null. In stead, try like this :

 

 

source= "2access_30DAY.log"
| eval "new_field"=coalesce('action',"Default String Here, change it per your need"). 10 | table "new_field"

 

  

SumanPalisetty
Path Finder

Sorry, I am being stupid. '.' operator allows concatenation of numeric and alphabets while '+' allows only concatenation of alphabets and numeric.

Regards

Suman P.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

For some of your events the action field is null/not present

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...