https://community.splunk.com/t5/Splunk-Search/Transaction-with-two-fields-have-that-have-the-same-value/m-p/171427#M49097 <P>in my logs the "connectionid" on one _raw log and the fcid</P> <P>I tried this </P> <P><CODE>sourcetype=foo | rename connectionid AS transactionid fcid AS transactionid | transaction transactionid</CODE></P> <P>and it seems to work but there has to be a better way.</P> Tue, 05 Aug 2014 16:23:06 GMT hartfoml 2014-08-05T16:23:06Z https://community.splunk.com/t5/Splunk-Search/Transaction-with-two-fields-have-that-have-the-same-value/m-p/171427#M49097 <P>in my logs the "connectionid" on one _raw log and the fcid</P> <P>I tried this </P> <P><CODE>sourcetype=foo | rename connectionid AS transactionid fcid AS transactionid | transaction transactionid</CODE></P> <P>and it seems to work but there has to be a better way.</P> Tue, 05 Aug 2014 16:23:06 GMT https://community.splunk.com/t5/Splunk-Search/Transaction-with-two-fields-have-that-have-the-same-value/m-p/171427#M49097 hartfoml 2014-08-05T16:23:06Z https://community.splunk.com/t5/Splunk-Search/Transaction-with-two-fields-have-that-have-the-same-value/m-p/171428#M49098 <P>Similar one</P> <P>sourcetype=foo | eval transactionid=coalesce(connectionid , fcid)| transaction transactionid</P> Tue, 05 Aug 2014 16:26:02 GMT https://community.splunk.com/t5/Splunk-Search/Transaction-with-two-fields-have-that-have-the-same-value/m-p/171428#M49098 somesoni2 2014-08-05T16:26:02Z https://community.splunk.com/t5/Splunk-Search/Transaction-with-two-fields-have-that-have-the-same-value/m-p/171429#M49099 <P>Somesoni,</P> <P>Thanks for the suggestion. Can you put this in as an answer so I can give you credit</P> Tue, 05 Aug 2014 18:10:29 GMT https://community.splunk.com/t5/Splunk-Search/Transaction-with-two-fields-have-that-have-the-same-value/m-p/171429#M49099 hartfoml 2014-08-05T18:10:29Z