Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Combine Dynamic Fields Starting with same value

$
0
0
So I have multiple fields whose field names could end with a different values. Examples of these fields are below: foo.foo_a = 1 foo.foo_b = 2 foo.foo_123 = null foo.foo_test = 4 What I want to do is combine all of these values into a single value. Essentially, I want a new value like below new_value= foo.foo_* where new_value would then be equal to: 1 2 4 If anybody could help guide me on this, it would be greatly appreciated. I was hoping that something like stats list(foo.foo_*) by field would have worked, but it doesn't provide the output that I am looking for, which is all of the fields combined into one.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>