Related Answers
Download topic as PDF
strcat
Description
Concatenates string values from 2 or more fields. Combines together string values and literals into a new field. A destination field name is specified at the end of the strcat command.
Syntax
strcat [allrequired=<bool>] <source-fields> <dest-field>
Required arguments
- <dest-field>
- Syntax: <string>
- Description: A destination field to save the concatenated string values in, as defined by the <source-fields> argument. The destination field is always at the end of the series of source fields.
- <source-fields>
- Syntax: (<field> | <quoted-str>)...
- Description: Specify the field names and literal string values that you want to concatenate. Literal values must be enclosed in quotation marks.
- quoted-str
- Syntax: "<string>"
- Description: Quoted string literals.
- Examples: "/" or ":"
Optional arguments
- allrequired
- Syntax: allrequired=<bool>
- Description: Specifies whether or not all source fields need to exist in each event before values are written to the destination field. If
allrequired=f, the destination field is always written and source fields that do not exist are treated as empty strings. Ifallrequired=t, the values are written to destination field only if all source fields exist. - Default: false
Usage
The strcat command is a distributable streaming command. See Command types.
Examples
Example 1:
Add a field called comboIP, which combines the source and destination IP addresses. Separate the addresses with a forward slash character.
... | strcat sourceIP "/" destIP comboIP
Example 2:
Add a field called comboIP, which combines the source and destination IP addresses. Separate the addresses with a forward slash character. Create a chart of the number of occurrences of the field values.
host="mailserver" | strcat sourceIP "/" destIP comboIP | chart count by comboIP
Example 3:
Add a field called address, which combines the host and port values into the format <host>::<port>.
... | strcat host "::" port address
See also
|
PREVIOUS stats |
NEXT streamstats |
This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.9, 6.6.8, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.5, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.2.0, 7.0.4, 7.0.6, 7.0.7, 7.0.8
Feedback submitted, thanks!