Splunk Search

join/append two queries




I have two different queries, I want to join two columns.

Below is my query:


msg="Finish import*" OR msg = "*inserted for*"
| rex field=msg "Finish import (?<dataField>.+)\s*at\s+(?P<datetime>\S+\s+\S+) processing time=(?<processingTime>\w+)" | where trim(dataField)="postcode"
| append [
search `macro` msg="*inserted for*"
| rex field=msg "(?<records>\d+)+\s[^\s].+for(?<dataField1>.*)" | where trim(dataField1)="postcode" ]

| eval records1 = records+":"+processingTime
| transaction msg maxpause=100s |
strcat records "::" processingTime recordsPr |

table datetime, dataField, records,ts,processingTime, recordsPr,dataField1.

I want to combine records and processingTime in one column like records:processingTime.

With eval records1 its doesnot concatenate but with string concatenate it looks like below:


Screen Shot 2020-06-26 at 10.44.50 PM.png

 Any help, would be appreciated.



Labels (4)
0 Karma



Since append creates a new record combining fields using eval won't work. Try using join command instead of append.

Then eval should work

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...