How to unite different fields into one field?

marxsabandana — Wed, 08 May 2019 06:27:12 GMT

I'm about to unite product codes from 2 different sourcetypes with different names, but with the same value.

Here's a sample table:
ProdID_1 (from sourcetype A)

0001596

ProdID_2 (from sourcetype B)
0001596

My desired output should be unified like this:
ProdID
0001596

Re: How to unite different fields into one field?

koshyk — Wed, 08 May 2019 07:34:22 GMT

There are quite few methods depending on how much other fields you want to protect/align
1. Using Rename

index=* (sourcetpe=A Or sourcetype=B) | rename ProdID_1 as ProdID| rename ProdID_2 as ProdID

index=* (sourcetpe=A Or sourcetype=B) | eval ProdID=ProdID_1 | eval ProdID=ProdID_2

Using transaction (if you want to club events of same ProdID into single transaction)

index=* (sourcetpe=A Or sourcetype=B) | rename ProdID_1 as ProdID| rename ProdID_2 as ProdID | transaction ProdID