topic Re: How to merge two field as sourcetype? in Splunk Search

How to merge two field as sourcetype?

rendie — Wed, 13 Jan 2021 08:09:26 GMT

Hi,

I wanna merge two fields into sourcetype as below:

props.conf

[source::/path/to/folder/*]
sourcetype = coalesce(field1,field2)

So, as result, I getting field sourcetype with the value "coalesce(field1,field2)". How to solve an issue?

Thanks.

General_Talos — Wed, 13 Jan 2021 08:21:03 GMT

Try in props.conf

[source::/path/to/folder/*] EVAL-sourcetype = coalesce(field1,field2)

rendie — Wed, 13 Jan 2021 10:58:57 GMT

Oh yeah, it works for me. Thank you