https://community.splunk.com/t5/Splunk-Search/COALESCE-command/m-p/387229#M173048 <P>hi<BR /> when I execute the query below</P> <PRE><CODE>index="x" sourcetype="WinEventLog:Microsoft-Windows-Diagnostics-Performance/Operational" </CODE></PRE> <P>I can display a field called "OpCode". This fields has many values and I want to display one of them<BR /> sometimes this field is in english, sometimes in french, sometimes in spain and sometimes in german<BR /> so I need to use "coalesce" like this</P> <PRE><CODE>| eval 'Boot_Degradation'=coalesce('Boot_Degradation','Détérioration du démarrage','Información del arranque','Startbeeinträchtigung') | table OpCode </CODE></PRE> <P>but it doesnt works<BR /> could you help me please???</P> Wed, 13 Feb 2019 14:29:11 GMT jip31 2019-02-13T14:29:11Z https://community.splunk.com/t5/Splunk-Search/COALESCE-command/m-p/387229#M173048 <P>hi<BR /> when I execute the query below</P> <PRE><CODE>index="x" sourcetype="WinEventLog:Microsoft-Windows-Diagnostics-Performance/Operational" </CODE></PRE> <P>I can display a field called "OpCode". This fields has many values and I want to display one of them<BR /> sometimes this field is in english, sometimes in french, sometimes in spain and sometimes in german<BR /> so I need to use "coalesce" like this</P> <PRE><CODE>| eval 'Boot_Degradation'=coalesce('Boot_Degradation','Détérioration du démarrage','Información del arranque','Startbeeinträchtigung') | table OpCode </CODE></PRE> <P>but it doesnt works<BR /> could you help me please???</P> Wed, 13 Feb 2019 14:29:11 GMT https://community.splunk.com/t5/Splunk-Search/COALESCE-command/m-p/387229#M173048 jip31 2019-02-13T14:29:11Z https://community.splunk.com/t5/Splunk-Search/COALESCE-command/m-p/387230#M173049 <P>It looks duplicate of</P> <P><A href="https://answers.splunk.com/answers/726556/help-on-coalesce-command.html">https://answers.splunk.com/answers/726556/help-on-coalesce-command.html</A></P> Wed, 13 Feb 2019 14:37:38 GMT https://community.splunk.com/t5/Splunk-Search/COALESCE-command/m-p/387230#M173049 vnravikumar 2019-02-13T14:37:38Z https://community.splunk.com/t5/Splunk-Search/COALESCE-command/m-p/387231#M173050 <P>Hello Jip31,</P> <P>Coalesce command is used to combine two or different fields from different or same sourcetype to perform further action.</P> <P>Kindly try to modify the above SPL and try to run.</P> <P>| eval 'Gen_OpCode'=coalesce('Boot_Degradation','Détérioration du démarrage','Información del arranque','Startbeeinträchtigung') <BR /> |table Gen_OpCode</P> Tue, 29 Sep 2020 23:16:29 GMT https://community.splunk.com/t5/Splunk-Search/COALESCE-command/m-p/387231#M173050 gouravdashtcs 2020-09-29T23:16:29Z