Splunk Search

join/append two queries




I have two different queries, I want to join two columns.

Below is my query:


msg="Finish import*" OR msg = "*inserted for*"
| rex field=msg "Finish import (?<dataField>.+)\s*at\s+(?P<datetime>\S+\s+\S+) processing time=(?<processingTime>\w+)" | where trim(dataField)="postcode"
| append [
search `macro` msg="*inserted for*"
| rex field=msg "(?<records>\d+)+\s[^\s].+for(?<dataField1>.*)" | where trim(dataField1)="postcode" ]

| eval records1 = records+":"+processingTime
| transaction msg maxpause=100s |
strcat records "::" processingTime recordsPr |

table datetime, dataField, records,ts,processingTime, recordsPr,dataField1.

I want to combine records and processingTime in one column like records:processingTime.

With eval records1 its doesnot concatenate but with string concatenate it looks like below:


Screen Shot 2020-06-26 at 10.44.50 PM.png

 Any help, would be appreciated.



Labels (4)
0 Karma



Since append creates a new record combining fields using eval won't work. Try using join command instead of append.

Then eval should work

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!