topic Re: Merge event field into single table column in Splunk Search

Merge event field into single table column

skottieb — Sat, 21 Jun 2014 02:44:30 GMT

Hi,
I'm trying to take filds from different events and put them in one table column. I've true this using the rename command, however, only the first rename files as SocialMediaPost it matched.

index="mail" (text!='' OR status!='' OR comment_text!='' OR message!='') | rename text as SocialPostData status as SocialPostData comment_text as SocialPostData message as SocialPostData | table URL User SocialPostData

Any help, much appreciated!

Scott-

Re: Merge event field into single table column

martin_mueller — Sat, 21 Jun 2014 09:19:09 GMT

What output are you getting now, and what does your desired output look like?

Re: Merge event field into single table column

skottieb — Sat, 21 Jun 2014 13:29:22 GMT

Now - 4 column of data.

text status comment_text message

It's+all+good.

This.%20Is.%20Awesome%21%21

please%20do%20tell%2C%20soon!

more%20random

tweeted

tweeteed

Test%20mobile%0A

this%20is%20comment%20data

tweeter

missing

Want this consolidated to 1.

data

It's+all+good.
This.%20Is.%20Awesome%21%21
please%20do%20tell%2C%20soon!
more%20random
tweeted
tweeteed
Test%20mobile%0A
this%20is%20comment%20data
tweeter

Re: Merge event field into single table column

martin_mueller — Sat, 21 Jun 2014 14:18:07 GMT

Hmm... you might be looking for this:

... | eval data = coalesce(text, status, comment_text, message) | fields - text status comment_text message

That will take the first value that isn't null and write it into the data field.

Re: Merge event field into single table column

skottieb — Sun, 22 Jun 2014 00:47:57 GMT

That is perfect. Thank you!