Merge 3 Splunk field into 1?

[POR160893]

Hi,

I am trying to concatenate 3 fields into 1 field but I am unable to do so.

I tried:

and this:

Can someone help? There should be a single column of emails with 1 email per row.

Thanks!

[POR160893 · Accepted solution]

Solved:

|table Reply_to_Email_Address, Return_Path_Email_Address, From_Email_Address
|eval Spoofed = mvappend(Reply_to_Email_Address, Return_Path_Email_Address, From_Email_Address )
| mvexpand Spoofed
|table Spoofed
|dedup Spoofed

[ITWhisperer]

use mvexpand newField in the first search

[POR160893]

I am still getting 3 emails per a single row ...

[ITWhisperer]

The first search used mvappend - add mvexpand to that search (not a different search with mvzip!)