About junlozhang

junlozhang · ‎05-09-2021

@kamlesh_vaghela Thanks for the solution about "\t". And what about Unicode character? Does it mean there is no way to concatenate a Unicode character and a string? Well, the reason I want to do this is that our log system has just switched to Splunk recently, and in order to make as least change as possible to the code of current downstream service, I'm trying to make the data fetched from Splunk has the same schema as the old log system (some fields in Splunk used to be separated by special character "\t" or Unicode character "\u0006")

junlozhang · ‎05-08-2021

I want to concatenate strings with special characters like "\t" and Unicode char "\u0006" I tried | makeresults | eval str="a"."\t"."b" And got a\tb But what I want is a b Also, I tried | makeresults | eval str="a"."\u0006"."b" And got a\u0006b What should I do?

junlozhang · ‎05-08-2021

Hi, I got another question: About string concat, I want the separator to be white space "\t", and I called the function like mvjoin(ExamDate, "\t") and I want a special Unicode character "\u0006" and I called the function like StudentName."\u0006".StudentId and I got the literal "\t" and "\u0006". Tom\u00061:2021-04-01,60\t2021-04-07,62 What should I do to get the real white space and Unicode character?

junlozhang · ‎05-07-2021

Let's say the data looks like: StudentName StudentId Grade ExamDate Tom 1 60 2021-04-01 Jerry 2 70 2021-04-01 Tom 1 62 2021-04-07 Jerry 2 55 2021-04-07 And the the result I want looks like: Formatted Tom,1:2021-04-01,60;2021-04-07,62 Jerry,2;2021-04-01,70;2021-04-07,55 I want to divide the origin data into groups by key "StudentId", and then merge the contents in each group to make a formatted string Of course, I can get all the data and write a program in Python or Java to process it.... But it would be better if I can do this only with SPL I have written a script to group by "StudentId": transaction StudentId | stats list(_raw) as rawList by StudentId But don't know what to do next

Posts	4
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎05-07-2021

Online Status	Offline
Date Last Visited	‎05-10-2021 04:41 AM

How to concatenate strings with unicode character?

How to merge the content of a group

Re: How to concatenate strings with unicode charac...

How to concatenate strings with unicode character?

Re: How to merge the content of a group

How to merge the content of a group