Splunk Search

combine multiple fields to a single field

kranthimutyala
Path Finder

I need to combine 3 fields as single field

eg:

Field1 Field2 Field3
3 6 xyz
4 7 56
5 abc ghj

Field4
3
4
5
6
7
abc
xyz
56
ghj

0 Karma

woodcock
Esteemed Legend

Like this:

... | eval mega = mvappend(mvappend(Field1, Field2), Field3)

With possibly this after that:

| stats values(mega) AS mega
0 Karma

HiroshiSatoh
Champion

Try this!

(your search)
| eval Field4=Field1.",".Field2.",".Field3
| fields - Field1,Field2,Field3
| makemv delim="," Field4
| mvexpand Field4
0 Karma

kranthimutyala
Path Finder

Thanks for the answer, how can we remove the unwanted values for eg: if the values contain symbol hyphen ( - ) or or NULL

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...