topic Re: How to combine two field results into single field permanently ? in Splunk Search

How to combine two field results into single field permanently ?

navd — Tue, 29 Sep 2020 21:12:13 GMT

Lets say I have extracted two fields rs_time1 and rs_time2. But now, I want to merge the values from these fields to one single field called rs_time . I have the following query, which does correctly what I wanted in search time , but is there a way to do it permanently rather than during search time ?

| eval "rs_time"=coalesce(rs_time1,rs_time2)
|stats avg(rs_time) as res_time

Re: How to combine two field results into single field permanently ?

horsefez — Thu, 06 Sep 2018 19:38:55 GMT

Hey @navd,

sure it's possible and you already have the right strategy with the coalesce command.

I posted you a link about Calculated Fields that will help you further.

http://docs.splunk.com/Documentation/Splunk/7.1.2/Knowledge/definecalcfields

Tell us if you need further assistance.

Re: How to combine two field results into single field permanently ?

horsefez — Fri, 07 Sep 2018 16:31:35 GMT

@navd,

did this help you?

Re: How to combine two field results into single field permanently ?

nick405060 — Fri, 07 Sep 2018 17:03:15 GMT

If the data comes from a heavy forwarder, you can use transforms.conf to create the merged field before the data is ingested to your indexers

Re: How to combine two field results into single field permanently ?

marycordova — Tue, 29 Sep 2020 21:10:06 GMT

please post a sample of the data
are the fields rs_time1 and rs_time2 always present in all events, mutually exclusive, or sometimes both, sometimes one of them, and sometimes neither?
are you performing the extraction or are they naturally identified fields by Splunk?

assuming Splunk is identifying the fields and that you have not manually extracted them:

in props.conf

[sourcetype]
EVAL-rs_time = if(isnotnull('rs_time1'),'rs_time1','rs_time2')