×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
junlozhang
Explorer
Member since: ‎05-07-2021
‎05-10-2021
Community Statistics
Posts 4
Solutions 0
Karma Given 1
Karma Received 0
Member Since ‎05-07-2021
Activity Feed
View All

Re: How to concatenate strings with unicode charac...

by in Splunk Search
‎05-09-2021 07:07 PM
‎05-09-2021 07:07 PM
@kamlesh_vaghela  Thanks for the solution about "\t". And what about Unicode character? Does it mean there is no way to concatenate a Unicode character and a string? Well, the reason I want to do this is that our log system has just switched to Splunk recently, and in order to make as least change as possible to the code of current downstream service, I'm trying to make the data fetched from Splunk has the same schema as the old log system (some fields in Splunk used to be separated by special character "\t" or Unicode character "\u0006")   ... View more

How to concatenate strings with unicode character?

by in Splunk Search
‎05-08-2021 01:58 AM
‎05-08-2021 01:58 AM
I want to concatenate strings with special characters like "\t" and Unicode char "\u0006" I tried     | makeresults | eval str="a"."\t"."b"     And got     a\tb     But what I want is     a b       Also, I tried     | makeresults | eval str="a"."\u0006"."b"     And got     a\u0006b       What should I do? ... View more

Re: How to merge the content of a group

by in Splunk Search
‎05-08-2021 12:06 AM
‎05-08-2021 12:06 AM
Hi, I got another question: About string concat,  I want the separator to be white space "\t", and I called the function like mvjoin(ExamDate, "\t") and I want a special Unicode character "\u0006" and I called the function like StudentName."\u0006".StudentId and I got the literal "\t" and "\u0006".  Tom\u00061:2021-04-01,60\t2021-04-07,62 What should I do to get the real white space and Unicode character? ... View more

How to merge the content of a group

by in Splunk Search
‎05-07-2021 03:20 AM
‎05-07-2021 03:20 AM
Let's say the data looks like: StudentName StudentId Grade ExamDate Tom 1 60 2021-04-01 Jerry 2 70 2021-04-01 Tom 1 62 2021-04-07 Jerry 2 55 2021-04-07 And the the result I want looks like: Formatted Tom,1:2021-04-01,60;2021-04-07,62 Jerry,2;2021-04-01,70;2021-04-07,55 I want to divide the origin data into groups by key "StudentId", and then merge the contents in each group to make a formatted string Of course, I can get all the data and write a program in Python or Java to process it.... But it would be better if I can do this only with SPL I have written a script to group by "StudentId":     transaction StudentId | stats list(_raw) as rawList by StudentId     But don't know what to do next ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎05-10-2021 04:41 AM
Karma given to
View All