Splunk Search

Is it possible to concatenate string with a number using eval?

SumanPalisetty
Path Finder

Hi,

Can we concatenate a string with a number using eval with '.' operator? I got to know that from a video, but when i do it, I am able to do it. I don't know what is going on. Kindly help.

eval1.png

Regards

Suman P.

Labels (1)
Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend
  • The plus ( + ) operator accepts two numbers for addition, or two strings for concatenation.
  • The period ( . ) operator concatenates both strings and number. Numbers are concatenated in their string represented form.

Check if the field "action" has null values. If it does, whole eval expression will be null. In stead, try like this :

 

 

source= "2access_30DAY.log"
| eval "new_field"=coalesce('action',"Default String Here, change it per your need"). 10 | table "new_field"

 

  

View solution in original post

somesoni2
Revered Legend
  • The plus ( + ) operator accepts two numbers for addition, or two strings for concatenation.
  • The period ( . ) operator concatenates both strings and number. Numbers are concatenated in their string represented form.

Check if the field "action" has null values. If it does, whole eval expression will be null. In stead, try like this :

 

 

source= "2access_30DAY.log"
| eval "new_field"=coalesce('action',"Default String Here, change it per your need"). 10 | table "new_field"

 

  

SumanPalisetty
Path Finder

Sorry, I am being stupid. '.' operator allows concatenation of numeric and alphabets while '+' allows only concatenation of alphabets and numeric.

Regards

Suman P.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

For some of your events the action field is null/not present

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...