How to Combine Events with matching data

BlueWombat45 — Mon, 20 Nov 2023 17:36:33 GMT

My current output looks like this:

Field1	Field2	FieldA	FieldB
John	Blue
		Blue	Ohio
		Yellow	Wyoming

However I need a way to link Field1 to FieldB if Field2=FieldA, where the output would look something like this:

Field1	Field2	FieldA	FieldB
John	Blue	Blue	Ohio
		Yellow	Wyoming

If there is a way to do something like this, please let me know, even if I need to create new fields. The excess FieldA and FieldB are unimportant if there is not a matching Field2.

please help, please

Re: How to Combine Events with matching data

ITWhisperer — Mon, 20 Nov 2023 18:08:39 GMT

message=* OR city=* | eval Field2=coalesce(Field2, FieldA) | stats values(*) as * by Field2 | where isnotnul(Field1)

topic Re: How to Combine Events with matching data in Splunk Search

How to Combine Events with matching data

Re: How to Combine Events with matching data