https://community.splunk.com/t5/Dashboards-Visualizations/How-to-combine-similar-and-different-values-of-two-fields/m-p/616478#M50620 <P>Hi <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/247443">@din98</a>&nbsp;,</P><P>you have to normalize your field and I hint to do this in a calculated field and not in your search.</P><P>In few word, you have to create two eval commands like thie following:</P><LI-CODE lang="markup">| eval state1=case(state1="Completed","Successful",state1="Faulted","Successful"), state2=case(state2="Completed","Successful",state2="Faulted","Successful")</LI-CODE><P>you can try them in a search, but after the test I hint to put then in two calculated fields.</P><P>then in the search use the coalesce option in the eval command</P><LI-CODE lang="markup">| eval state=coalesce(state1,state2)</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Mon, 10 Oct 2022 06:12:08 GMT gcusello 2022-10-10T06:12:08Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-combine-similar-and-different-values-of-two-fields/m-p/616477#M50619 <P><SPAN><BR /><BR /><BR /></SPAN></P> Sun, 12 Mar 2023 12:59:49 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-combine-similar-and-different-values-of-two-fields/m-p/616477#M50619 din98 2023-03-12T12:59:49Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-combine-similar-and-different-values-of-two-fields/m-p/616478#M50620 <P>Hi <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/247443">@din98</a>&nbsp;,</P><P>you have to normalize your field and I hint to do this in a calculated field and not in your search.</P><P>In few word, you have to create two eval commands like thie following:</P><LI-CODE lang="markup">| eval state1=case(state1="Completed","Successful",state1="Faulted","Successful"), state2=case(state2="Completed","Successful",state2="Faulted","Successful")</LI-CODE><P>you can try them in a search, but after the test I hint to put then in two calculated fields.</P><P>then in the search use the coalesce option in the eval command</P><LI-CODE lang="markup">| eval state=coalesce(state1,state2)</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Mon, 10 Oct 2022 06:12:08 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-combine-similar-and-different-values-of-two-fields/m-p/616478#M50620 gcusello 2022-10-10T06:12:08Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-combine-similar-and-different-values-of-two-fields/m-p/616748#M50639 <P>&nbsp;,</P> Sun, 12 Mar 2023 13:00:56 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-combine-similar-and-different-values-of-two-fields/m-p/616748#M50639 din98 2023-03-12T13:00:56Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-combine-similar-and-different-values-of-two-fields/m-p/616810#M50650 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/247443">@din98</a>,</P><P>you can add all the conditions you have, I don't know if it's possible in your logs, but you could have:</P><LI-CODE lang="markup">| eval state1=case(state1="Completed","Successful",state1="Faulted","Successful",state2="Pending","Pending"), state2=case(state2="Completed","Successful",state2="Faulted","Successful",state2="Pending","Pending")</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Wed, 12 Oct 2022 12:06:00 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-combine-similar-and-different-values-of-two-fields/m-p/616810#M50650 gcusello 2022-10-12T12:06:00Z