topic Re: SPL query in Splunk Search

How can I rename items with SPL query?

uagraw01 — Sat, 30 Apr 2022 19:38:56 GMT

Hello Splunkers,

How can i rename all the OrderNumber1, OrderNumber2, OrderNumber3 as OrderNumber. And Country1, Country2,Country4 as Country. I have attached the screenshot also.

Appreciated in advance

Re: SPL query

gcusello — Fri, 29 Apr 2022 15:34:08 GMT

Hi @uagraw01 ,

if the field numbers is fixed, you can use coalesce option:

| eval OrderNumber=coalesce(OrderNumber1,OrderNumber2,OrderNumber3), country=coalesce(country1,country2,country3)

Ciao.

Giuseppe

Re: SPL query

VatsalJagani — Fri, 29 Apr 2022 15:38:09 GMT

@uagraw01 - You can use the same formula as part of props.conf EVAL statement as well.

Re: SPL query

uagraw01 — Fri, 29 Apr 2022 16:10:22 GMT

@gcusello I already tried this. But let me know is this a good approach ?

Re: SPL query

uagraw01 — Fri, 29 Apr 2022 16:12:28 GMT

@VatsalJagani I have some limitations here.

Re: SPL query

VatsalJagani — Fri, 29 Apr 2022 16:18:03 GMT

@uagraw01 - Use the solution given by @gcusello if you want to get one value out of all the fields.

If you want all values from those fields into a new multi-valued field, then you can try:

| eval Country = mvappend(Country1, Country2, ...) | eval OrderNumber = mvappend(OrderNumber1, OrderNumber2, ...)

I hope this helps!!

Re: SPL query

gcusello — Sat, 30 Apr 2022 09:02:43 GMT

Hi @uagraw01,

Yes, coalesce is very much used option.

Ciao.

Giuseppe