topic Re: How to handle a field alias for two fields in search results when the source type is the same? in Getting Data In

How to handle a field alias for two fields in search results when the source type is the same?

arrowecssupport — Wed, 23 Nov 2016 16:37:29 GMT

We have data which can display a computer's serial number. The data is a little odd and we have to extract the serial number using 1 rex and 1 is done automatically. This creates 2 fields serialnumber1 & serialnumber2 .

I've tried to create an alias called serialnumber, but I've run into problems.

Applies to sourcetype = imap
Field aliases >  serialnumber1 =serialnumber
Field aliases >  serialnumber2 =serialnumber

The problem is that when both fields are populated, serialnumber is populated

1. When serialnumber1 is NULL and serialnumber2 is populated, "serialnumber" is populated
2. When serialnumber1 is populated and serialnumber2 is NULL,"serialnumber" IS NOT POPULATED
3. When Both serialnumber1 & serialnumber2 are populated, "serialnumber" is populated

Why is this case that when search result 2. above is true the aliases fail.

Re: How to handle a field alias for two fields in search results when the source type is the same?

gcusello — Wed, 23 Nov 2016 16:48:11 GMT

Hi arrowecssupport,
if you can fix a priority in fields use, you could you coalesce function:
| eval serialnumber=coalesce(serialnumber1,serialnumber2)

Bye.
Giuseppe

Re: How to handle a field alias for two fields in search results when the source type is the same?

arrowecssupport — Thu, 24 Nov 2016 15:00:12 GMT

Thanks that appears to work and might work in some situations.
Problem is want to be able to create a search into an Event type and this isn't possible when you use a pipe.

Re: How to handle a field alias for two fields in search results when the source type is the same?

woodcock — Sat, 11 Mar 2017 16:53:21 GMT

If it is an eventtype then you can obscure the fact that there are 2 fields by making it use the search serialnumber1="MyValue" OR serialnumber2="MyValue". Then you can access it through a macro that adds the coalesce command so your search would be:

`MyMacro` | rest of your search