FAQ: How do I concatenate two fields into a new single field?

You can use concat() and select() to take two fields and put them both into a single, new field. In the following example, the fields UID and UserSid are collected and entered into a new field named userIdentifier:

#event_simpleName=ProcessRollup2
| concat([UID, UserSid], as="userIdentifier")
| select([@timestamp, aid, userIdentifier, ImageFileName])