topic Combine fields into new field without NULL in Splunk Search https://community.splunk.com/t5/Splunk-Search/Combine-fields-into-new-field-without-NULL/m-p/218140#M188022 <P>From our data we end up with 2 different fields v7serial &amp; v8serial. I want to be able to feed this into a single serial v78serial.</P> <P>Example of data<BR /> v7serial<BR /> 987654321</P> <P>v8serial<BR /> 123456789</P> <P>v78serial<BR /> 123456789<BR /> 987654321</P> <P>I am trying</P> <P>| eval v78serial= toString(v8serial) + ";" + toString(v7serial) <BR /> | makemv delim=";" allserials<BR /> | mvexpand v78serial | table v78serial</P> <P>The problem is when i display this data or try to use this field i get "123456789;null" this is because the data has either a v7 or v8 serial never both. So where one field is Null then don't add it to the new field. </P> Thu, 23 Jun 2016 15:51:07 GMT arrowecssupport 2016-06-23T15:51:07Z Combine fields into new field without NULL https://community.splunk.com/t5/Splunk-Search/Combine-fields-into-new-field-without-NULL/m-p/218140#M188022 <P>From our data we end up with 2 different fields v7serial &amp; v8serial. I want to be able to feed this into a single serial v78serial.</P> <P>Example of data<BR /> v7serial<BR /> 987654321</P> <P>v8serial<BR /> 123456789</P> <P>v78serial<BR /> 123456789<BR /> 987654321</P> <P>I am trying</P> <P>| eval v78serial= toString(v8serial) + ";" + toString(v7serial) <BR /> | makemv delim=";" allserials<BR /> | mvexpand v78serial | table v78serial</P> <P>The problem is when i display this data or try to use this field i get "123456789;null" this is because the data has either a v7 or v8 serial never both. So where one field is Null then don't add it to the new field. </P> Thu, 23 Jun 2016 15:51:07 GMT https://community.splunk.com/t5/Splunk-Search/Combine-fields-into-new-field-without-NULL/m-p/218140#M188022 arrowecssupport 2016-06-23T15:51:07Z Re: Combine fields into new field without NULL https://community.splunk.com/t5/Splunk-Search/Combine-fields-into-new-field-without-NULL/m-p/218141#M188023 <P>Try like this</P> <PRE><CODE>your base search | eval v78serial=coalesce(v8serial,v7serial,"") | table v78serial </CODE></PRE> Thu, 23 Jun 2016 16:01:32 GMT https://community.splunk.com/t5/Splunk-Search/Combine-fields-into-new-field-without-NULL/m-p/218141#M188023 somesoni2 2016-06-23T16:01:32Z