Splunk Search

Is there a way to combine field values from different events?

kdimaria
Communicator

Basically I am trying to see if there is a way to do an eval to grab a field value from two different events. For example lets say I have:

Application=Chrome Note=this is an application
Application=Chrome Note=this is an application2

So I want to see if there is a way to make a new field where Application=Chrome that combines the two notes together into another field. so it'd add a field that is like Newnote=this is an application this is an applcation2.

0 Karma
1 Solution

niketn
Legend

Are you looking for the following?

| stats list(Note) as NewNote by Application
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

vasanthmss
Motivator

When there is an similar Application comes all the notes will be added into Newnote field.

Try the below search,

... your base search | eventstats values(Note) as Newnote by Application | nomv Newnote 

Hope this will helps you.

V

niketn
Legend

Are you looking for the following?

| stats list(Note) as NewNote by Application
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

kdimaria
Communicator

Thank you this worked 🙂

0 Karma
Get Updates on the Splunk Community!

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Community Content Calendar, October Edition

Welcome to the October edition of our Community Spotlight! The Splunk Community is a treasure trove of ...