how to append only two adjacent columns in a table?

[_jgpm_]

I've already tried foreach, untable, and trim/mvappend in various combinations to solve this problem.

I have 30 columns of information (edit: And I don't want to specify them as they are dynamic), 1 column of text labels. I want to append pairs of the table together.

ex. data:
week |A-txt1 | B-txt1 | A-txt2 | B-txt2 etc...
0005 | 0002 | 00001 | 00003 | 00006

I want have column event data that looks like:
week | AB-txt1 |
0005 | 002:001 |

Ignore the leading zeros; I was trying to make the columns match up.

Can some wizard apply their sorcery?

Thanks.

[niketn]

Following is with eval for 4 sample fields A-txt1, B-txt1, A-txt2, B-txt2:

<your base search> | eval AB-txt1='A-txt1' + ":" + 'B-txt1' | eval AB-txt2='A-txt2' + ":" + 'B-txt2' | table _time week AB-txt1 AB-txt2

Following is with foreach for above eval(you can have n number of fields below, However, final table comand needs to be adjusted:

<your base search> | foreach *-txt* matchseg2="#matchseg2#" [eval AB-txt#matchseg2#='A-txt#matchseg2#' + ":" + 'B-txt#matchseg2#'] | table week AB-txt1 AB-txt2

[jkat54]

...| eval a=mvzip(a-txt1,b-txt1) | eval b=mvzip(a,c-txt1) | ...

So on an so forth...

[sundareshr · Accepted solution]

Is this what you're looking for (this is a run-anywhere sample)

| makeresults | eval week="0005" | eval A-txt1="0002" | eval B-txt1="0001" | eval A-txt2="0003" | eval B-txt2="0006" | table week *txt* | untable week fields data | rex field=fields "(?<label>\w)-(?<text>\w+)" | table week label text data | mvcombine data delim=":" | stats values(label) as label values(data) as data by week text  | makemv label delim="_" | makemv data delim=":" | eval field=label."-".text | xyseries week field data

[dmaislin_splunk]

| strcat A-txt1 ":" B-txt1 AB-text1

This will create the field you want.