topic Re: How can I parse 2 columns with text format together? in Getting Data In

How can I parse 2 columns with text format together?

mklhs — Tue, 29 Oct 2019 15:20:11 GMT

I have 2 columns with text format (data 1 and data 2). One of the two columns is empty. I want to parse the 2 columns into a separate column together (data3).

P.S search | eval data3 = coalesce(data1, data2) it doesn't work

Re: How can I parse 2 columns with text format together?

HiroshiSatoh — Tue, 29 Oct 2019 15:56:30 GMT

Do I need to add it?

 | eval data3 = if(isnull(data1), data2,data1)

Re: How can I parse 2 columns with text format together?

mklhs — Wed, 30 Oct 2019 12:04:28 GMT

Hello @HiroshiSatoh,

the column "data3" is empty. So, the column "data1" and "data2" were not parsed together. Do you know what it might be?

Re: How can I parse 2 columns with text format together?

HiroshiSatoh — Wed, 30 Oct 2019 14:50:56 GMT

Is there a space in the field name?
If there is a space, please enclose it with a single quote.

data□1
↓
'data□1'

Re: How can I parse 2 columns with text format together?

to4kawa — Sat, 30 Nov 2019 07:53:44 GMT

| makeresults
| eval _raw="time,\"data 1\",\"data 2\",\"data 3\"
2019-10-29 15:50:00.109+02:00,#user1#20191029155000#,
2019-10-29 15:51:00.109+02:00,,#user1#20191029155100#,
2019-10-29 15:52:00.109+02:00,#user1#20191029155200#,"
| multikv forceheader=1
| rename data_*_ as "data "*
| table time "data "*
`comment("this is sample data")`
| eval "data 3" = coalesce('data 1','data 2')

If you can describe the field name correctly, coalesce works.