Splunk Search

How to create common name for 3 different fields in an event?

Navanitha
Path Finder

I have event like below and I am trying to create a common field for  CI_Name / Hostname /IP_Address and name it as Generic_HostName.

2023-06-21 07:46:38.701, CI_Name="abc.xyz.net", Hostname="abc", Domain="xyz.net", System_Role="DR", Environment="DR", IP_Address="40.90.20.10", Tier1="Hosting", Tier2="Processing unit", Tier3="Server", BU="poc", Operating_System="Red Hat Enterprise Linux 7.9", OS_Version="7.9",

 

So when I do a stats on Generic_Hostname, the result should have CI_Name, Hostname, IP_Address.

index=* | stats count by Generic_Hostname

Output:

abc.xyz.net

abc

40.90.20.10

 

How can I achieve this?  

 

Labels (2)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

The command you are looking for is mvappend.

Generic_Hostname = mvappend(CI_Name, Hostname, IP_Address)

Hope this helps.

View solution in original post

Tags (1)

yuanliu
SplunkTrust
SplunkTrust

The command you are looking for is mvappend.

Generic_Hostname = mvappend(CI_Name, Hostname, IP_Address)

Hope this helps.

Tags (1)

Navanitha
Path Finder

Thank you @yuanliu.  This is exactly what I was looking for.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...