Concatenates string values.
strcat [allrequired=<bool>] <srcfields>* <destfield>
- Syntax: <string>
- Description: A destination field to save the concatenated string values defined by srcfields. The destfield is always at the end of the series of srcfields.
- Syntax: (<field>|<quoted-str>)
- Description: Specify either key names or quoted literals.
- Syntax: "<string>"
- Description: Quoted literals.
- Syntax: allrequired=<bool>
- Description: Specifies whether or not all source fields need to exist in each event before values are written to the destination field. By default, allrequired=f, meaning that the destination field is always written and source fields that do not exist are treated as empty strings. If allrequired=t, the values are written to destination field only if all source fields exist.
Stitch together fields and/or strings to create a new field. Quoted tokens are assumed to be literals and the rest field names. The destination field name is always at the end.
Example 1: Add the field, comboIP, which combines the source and destination IP addresses and separates them with a front slash character.
... | strcat sourceIP "/" destIP comboIP
Example 2: Add the field, comboIP, and then create a chart of the number of occurrences of the field values.
host="mailserver" | strcat sourceIP "/" destIP comboIP | chart count by comboIP
Example 3: Add a field, address, which combines the host and port values into the format <host>::<port>.
... | strcat host "::" port address
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the strcat command.
This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 , 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 , 4.3 , 4.3.1 , 4.3.2 , 4.3.3 , 4.3.4 , 4.3.5 , 4.3.6 , 5.0 , 5.0.1 , 5.0.2