Merge 3 Splunk field into 1?

[POR160893]

Hi,

I am trying to concatenate 3 fields into 1 field but I am unable to do so.

I tried:

POR160893_0-1665051787383.png

and this:

POR160893_1-1665051840074.png

Can someone help? There should be a single column of emails with 1 email per row.

Thanks!

[POR160893 · Accepted solution]

Solved:

|table Reply_to_Email_Address, Return_Path_Email_Address, From_Email_Address
|eval Spoofed = mvappend(Reply_to_Email_Address, Return_Path_Email_Address, From_Email_Address )
| mvexpand Spoofed
|table Spoofed
|dedup Spoofed

[ITWhisperer]

use mvexpand newField in the first search

[POR160893]

I am still getting 3 emails per a single row ...

POR160893_0-1665052972057.png

[ITWhisperer]

The first search used mvappend - add mvexpand to that search (not a different search with mvzip!)