Splunk Search

how to format the output of a splunk query ?

rajs115
Path Finder

Hi,

  I have a splunk query which results the two outputs (using table) such as "JOB_NAME" and "JOB_ID".

   For example, the output values are 'job_name' is  'abcd' and 'job_id' is '456'.  The final output i would like to get is  "abcd-456".

How can i update the splunk query to merge two outputs as one ?

 

Thanks. 

   

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Use an eval with the concatenation operator to produce a new field.

| eval foo = job_name . "-" . job_id
| table foo

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Use an eval with the concatenation operator to produce a new field.

| eval foo = job_name . "-" . job_id
| table foo

 

---
If this reply helps you, Karma would be appreciated.

rajs115
Path Finder

@richgalloway ,

  The command you suggested is working as i need. I have another question. The JOB_NAME output is "abcd.exe". The output i am getting after running the command you suggested is "abcd.exe-456". Can you please suggest me how to delete '.exe' from the output?

Thanks.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There are few ways to do that.

1) Strip .exe from JOB_NAME before concatenation.

| eval JOB_NAME=replace(JOB_NAME,".exe","")
| eval foo=JOB_NAME."-".JOB_ID

2) Strip .exe from JOB_NAME during concatenation.

| eval foo=replace(JOB_NAME,".exe","")."-".JOB_ID

3) Remove .exe from the concatenated string afterwards.

| eval foo=JOB_NAME."-".JOB_ID
| eval foo=replace(foo, ".exe", "")

There are alternative methods for each of these.

---
If this reply helps you, Karma would be appreciated.

rajs115
Path Finder

@richgalloway ,

 

  Your answer is perfectly fine. I have a small problem running the query to replace an extension. To get this right, i am trying to extract a git url in my actual task. The git url looks like below.

 https://git.mycompany.project.git

  here, i am trying to remove '.git' from the end of the project url. I am running below command you suggested, 

 to remove '.git' . But there is name 'git' at the beginning of the url as well. 

| eval foo=replace(JOB_NAME,".git","")."-".JOB_ID

 

The final output is coming like this.

expected output:   https://git.mycompany.project

Actual output:  https:/.mycompany.project

  I just want to eliminate the .git at the end of the url. Not the first .git from url. Can you please suggest me how to overcome this?

 

Thanks.

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this alternative command.

| rex field=foo mode=sed "s/\.git$//"
---
If this reply helps you, Karma would be appreciated.
0 Karma

rajs115
Path Finder

@richgalloway ,

 

  This is how i am extracting the JOB_NAME form the splunk logs

Logs:

proj_url\tst[0;x= https://git.mycompany.project.git plan\tst[0;x=XbzuPbsj


Splunk query i am using here:

       | rex "(?<url>https\S+)"

The output returns the value of https://git.mycompany.project.git .

 

Is there a way to eliminate .git in this query and return just  https://git.mycompany.project ?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I don't have a definitive way to extract url without the .git on the end.  I suggest using the rex command above to remove .git from url after it is extracted.

---
If this reply helps you, Karma would be appreciated.

rajs115
Path Finder

Now i understood how to run it properly. All working good now. Thank you

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

rajs115
Path Finder
Hi rich, I already accepted your first comment as the solution to my question. Thanks.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...