Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to combine multiple field values to create single field name in eval statement.

$
0
0
Hi, I'm trying to combine the values of multiple fields to together form a single field name in an eval if statement. Something like the example below. Is that in any way possible? Thanks for your help! | eval {operation}_{merchant}_{country}=if((operation=operation AND country=country AND merchant=merchant), {operation}_{merchant}_{country}+1, 0)

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>