https://community.splunk.com/t5/Splunk-Search/Joining-two-fields-together/m-p/19349#M2932 <P>Coalesce is probably not what you want; it picks the first non-null from the list and returns that. Instead, string manipulation will do what you want:</P> <P><CODE><BR /> eval newField=EventCodeDescription + sfailed<BR /> </CODE></P> Fri, 27 Jul 2012 19:55:57 GMT sowings 2012-07-27T19:55:57Z https://community.splunk.com/t5/Splunk-Search/Joining-two-fields-together/m-p/19347#M2930 <P>How do I join two fields together so there is not whitespace in my table. I want to join sfailed and EventCodeDescription so that it will list "Shutdown or reboot"</P> <P>index="Desktop" (EventCode=513 OR EventCode=3003) OR reboot EventCodeDescription= "sfailed" OR "Shutdown"| rex"Shutdown\s\S+(?<SFAILED>\s\S+)" | table _time sfailed host user EventCodeDescription | rename _time AS Time | convert timeformat="%H/%M/%S %d.%m.%Y" ctime(Time) | rename user AS Username | rename host AS "Machine Name" EventCodeDescription AS "Description" </SFAILED></P> Fri, 27 Jul 2012 11:07:48 GMT https://community.splunk.com/t5/Splunk-Search/Joining-two-fields-together/m-p/19347#M2930 Michael_Schyma1 2012-07-27T11:07:48Z https://community.splunk.com/t5/Splunk-Search/Joining-two-fields-together/m-p/19348#M2931 <P>You should probably use <A href="http://docs.splunk.com/Documentation/Splunk/latest/searchreference/eval">eval</A> to create a new field, and then use <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions">coalesce</A> to combine these two fields. e.g.</P> <P>...| eval newField=coalesce(EventCodeDescription,sfailed)|...</P> Fri, 27 Jul 2012 11:14:30 GMT https://community.splunk.com/t5/Splunk-Search/Joining-two-fields-together/m-p/19348#M2931 MHibbin 2012-07-27T11:14:30Z https://community.splunk.com/t5/Splunk-Search/Joining-two-fields-together/m-p/19349#M2932 <P>Coalesce is probably not what you want; it picks the first non-null from the list and returns that. Instead, string manipulation will do what you want:</P> <P><CODE><BR /> eval newField=EventCodeDescription + sfailed<BR /> </CODE></P> Fri, 27 Jul 2012 19:55:57 GMT https://community.splunk.com/t5/Splunk-Search/Joining-two-fields-together/m-p/19349#M2932 sowings 2012-07-27T19:55:57Z