https://community.splunk.com/t5/Splunk-Search/eval-coalesce/m-p/47892#M11437 <P><CODE>coalesce</CODE> takes a number of fields and returns the first one that is not null. So, if that's the behaviour you want, your query seems fine to me.</P> Thu, 29 Nov 2012 12:10:05 GMT Ayn 2012-11-29T12:10:05Z https://community.splunk.com/t5/Splunk-Search/eval-coalesce/m-p/47889#M11434 <P>I'm trying to normalize various user fields within Windows logs. The fields I'm trying to combine are users Users and Account_Name.</P> <P>My query isn't failing but I don't think I'm quite doing this correctly.</P> <P>I'm using the string:<BR /> | eval allusers=coalesce(users,Users,Account_Name)</P> Wed, 28 Nov 2012 19:28:58 GMT https://community.splunk.com/t5/Splunk-Search/eval-coalesce/m-p/47889#M11434 hagjos43 2012-11-28T19:28:58Z https://community.splunk.com/t5/Splunk-Search/eval-coalesce/m-p/47890#M11435 <P>Do you want to concatenate those fields or use the first in that list that is not null?</P> Wed, 28 Nov 2012 20:13:15 GMT https://community.splunk.com/t5/Splunk-Search/eval-coalesce/m-p/47890#M11435 Ayn 2012-11-28T20:13:15Z https://community.splunk.com/t5/Splunk-Search/eval-coalesce/m-p/47891#M11436 <P>I want to not have duplicates that may exist in both fields.<BR /> Jsmith may have logged onto a Win Server 2k3 box and the field is called "users" then he may log onto a win 2k8 box and the field is called "Users" The differences being the uppercase and lowercase "u"</P> Thu, 29 Nov 2012 11:27:30 GMT https://community.splunk.com/t5/Splunk-Search/eval-coalesce/m-p/47891#M11436 hagjos43 2012-11-29T11:27:30Z https://community.splunk.com/t5/Splunk-Search/eval-coalesce/m-p/47892#M11437 <P><CODE>coalesce</CODE> takes a number of fields and returns the first one that is not null. So, if that's the behaviour you want, your query seems fine to me.</P> Thu, 29 Nov 2012 12:10:05 GMT https://community.splunk.com/t5/Splunk-Search/eval-coalesce/m-p/47892#M11437 Ayn 2012-11-29T12:10:05Z