<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Why does alias not always work as expected? in Knowledge Management</title>
    <link>https://community.splunk.com/t5/Knowledge-Management/Why-does-alias-not-always-work-as-expected/m-p/220167#M1930</link>
    <description>&lt;P&gt;In my Results, for each event, I can only get field A OR field B.&lt;BR /&gt;
I created two aliases:  A=C, B=C&lt;BR /&gt;
So each event should have C with a value.&lt;BR /&gt;&lt;BR /&gt;
But in the result, I can see that sometimes C gets value A, sometimes value B, and sometimes Blank.&lt;/P&gt;</description>
    <pubDate>Tue, 15 Nov 2016 06:39:17 GMT</pubDate>
    <dc:creator>marcus_doron</dc:creator>
    <dc:date>2016-11-15T06:39:17Z</dc:date>
    <item>
      <title>Why does alias not always work as expected?</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Why-does-alias-not-always-work-as-expected/m-p/220167#M1930</link>
      <description>&lt;P&gt;In my Results, for each event, I can only get field A OR field B.&lt;BR /&gt;
I created two aliases:  A=C, B=C&lt;BR /&gt;
So each event should have C with a value.&lt;BR /&gt;&lt;BR /&gt;
But in the result, I can see that sometimes C gets value A, sometimes value B, and sometimes Blank.&lt;/P&gt;</description>
      <pubDate>Tue, 15 Nov 2016 06:39:17 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Why-does-alias-not-always-work-as-expected/m-p/220167#M1930</guid>
      <dc:creator>marcus_doron</dc:creator>
      <dc:date>2016-11-15T06:39:17Z</dc:date>
    </item>
    <item>
      <title>Re: Why does alias not always work as expected?</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Why-does-alias-not-always-work-as-expected/m-p/220168#M1931</link>
      <description>&lt;P&gt;Hi marcus_doron,&lt;BR /&gt;
If you have only one of the three field with value or if you have an order of importance in your fields, you could use the coalesce function:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| eval C=coalesce(C,A,B)
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;in this way your C field take value, in order, from C, A, B.&lt;/P&gt;

&lt;P&gt;Bye.&lt;BR /&gt;
Giuseppe&lt;/P&gt;</description>
      <pubDate>Tue, 15 Nov 2016 15:10:06 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Why-does-alias-not-always-work-as-expected/m-p/220168#M1931</guid>
      <dc:creator>gcusello</dc:creator>
      <dc:date>2016-11-15T15:10:06Z</dc:date>
    </item>
  </channel>
</rss>

