https://community.splunk.com/t5/Splunk-Search/How-to-normalize-events-with-multiple-keys/m-p/213089#M62478 <P>Try this</P> <PRE><CODE>.... | eval NodeName="Node".substr("000", coalesce(NodeId, Node), -3) </CODE></PRE> Sat, 18 Jun 2016 18:32:10 GMT sundareshr 2016-06-18T18:32:10Z https://community.splunk.com/t5/Splunk-Search/How-to-normalize-events-with-multiple-keys/m-p/213088#M62477 <P>I have a couple of fields, <STRONG>Node</STRONG> and <STRONG>NodeID</STRONG>, which will both have a number. Then I have <STRONG>NodeName</STRONG> which is of the format "Node001", so to make sure they all have a NodeName, I did this</P> <PRE><CODE>eval NodeName="Node".substr("000".NodeId,-3) | eval NodeName = "Node".substr("000".Node,-3) </CODE></PRE> <P>However, this seems rather wasteful. How would I combine this into one statement? It's unlikely an event will have both Node and NodeID, but I'd have to dig through the data more</P> Sat, 18 Jun 2016 17:55:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-normalize-events-with-multiple-keys/m-p/213088#M62477 jrich523 2016-06-18T17:55:14Z https://community.splunk.com/t5/Splunk-Search/How-to-normalize-events-with-multiple-keys/m-p/213089#M62478 <P>Try this</P> <PRE><CODE>.... | eval NodeName="Node".substr("000", coalesce(NodeId, Node), -3) </CODE></PRE> Sat, 18 Jun 2016 18:32:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-normalize-events-with-multiple-keys/m-p/213089#M62478 sundareshr 2016-06-18T18:32:10Z