topic Re: Merge 2 columns into one in Splunk Search

Merge 2 columns into one

premraj_vs — Mon, 12 Jun 2017 05:10:27 GMT

I have a query that returns a table like below

Component Hits ResponseTime Req-count
Comp-1 100 2.3
Comp-2 5.6 240

Both Hits and Req-count means the same but the header values in CSV files are different. I want the result to look like

Component Hits ResponseTime
Comp-1 100 2.3
Comp-2 240 5.6

I should make both the fields as same. I tried rename and it did not work.

It would be very helpful if someone can share their suggestions.

cmerriman — Mon, 12 Jun 2017 11:48:13 GMT

have you tried coalesce? |eval newField=coalesce(Hits,'Req-count')|fields - Hits "Req-Count"

DalJeanis — Mon, 12 Jun 2017 14:49:17 GMT

Please post the exact search code with the rename that did not work Remember to mark it as code so that the interface will not alter the code.

I suspect that the problem is a capitalization or spelling error, either in the rename line or in a prior line.

woodcock — Mon, 12 Jun 2017 17:42:23 GMT

Just tack on one extra line, like this:

Your Existing Search Here
| eval Hits = coalesce(Hits, 'Req-count') | fields - "Req-Count"