strcat
strcat
Synopsis
Concatenates string values.
Syntax
strcat [allrequired=<bool>] <srcfields>* <destfield>
Required arguments
- <destfield>
- Syntax: <string>
- Description: A destination field to save the concatenated string values defined by srcfields. The destfield is always at the end of the series of srcfields.
- <srcfields>
- Syntax: (<field>|<quoted-str>)
- Description: Specify either key names or quoted literals.
- quoted-str
- Syntax: "<string>"
- Description: Quoted literals.
Optional arguments
- allrequired
- Syntax: allrequired=<bool>
- Description: Specifies whether or not all source fields need to exist in each event before values are written to the destination field. By default, allrequired=f, meaning that the destination field is always written and source fields that do not exist are treated as empty strings. If allrequired=t, the values are written to destination field only if all source fields exist.
Description
Stitch together fields and/or strings to create a new field. Quoted tokens are assumed to be literals and the rest field names. The destination field name is always at the end.
Examples
Example 1: Add the field, comboIP, which combines the source and destination IP addresses and separates them with a front slash character.
... | strcat sourceIP "/" destIP comboIPExample 2: Add the field, comboIP, and then create a chart of the number of occurrences of the field values.
host="mailserver" | strcat sourceIP "/" destIP comboIP | chart count by comboIPExample 3: Add a field, address, which combines the host and port values into the format <host>::<port>.
... | strcat host "::" port addressSee also
Answers
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the strcat command.
This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 , 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 , 4.3 , 4.3.1 , 4.3.2 , 4.3.3 , 4.3.4 , 4.3.5 , 4.3.6 , 5.0 , 5.0.1 , 5.0.2 View the Article History for its revisions.