https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-fields-to-one-field/m-p/219979#M64659 <P>I WANT TO COMBINE THOSE TIMESTAMP INTO ONE COLUMN HOW CAN I DO THAT </P> <P>BUT I DON'T WANT USE THE TRANSACTION COMMAND</P> <P>HELP ME GUYS THE SAMPLE TABLE </P> <P>ID TIMESTAMP1 TIMESTAMP2 <BR /> 1 --------- ------ 201<BR /> 1 210 ------------------<BR /> 2 --------------- 310<BR /> 2 310 --------------- </P> <P>I WANT TO COMBINE BOTH OF THEM BUT DON'T USE TRANSACTION COMMAND.</P> Mon, 14 Nov 2016 20:33:52 GMT prashanthberam 2016-11-14T20:33:52Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-fields-to-one-field/m-p/219979#M64659 <P>I WANT TO COMBINE THOSE TIMESTAMP INTO ONE COLUMN HOW CAN I DO THAT </P> <P>BUT I DON'T WANT USE THE TRANSACTION COMMAND</P> <P>HELP ME GUYS THE SAMPLE TABLE </P> <P>ID TIMESTAMP1 TIMESTAMP2 <BR /> 1 --------- ------ 201<BR /> 1 210 ------------------<BR /> 2 --------------- 310<BR /> 2 310 --------------- </P> <P>I WANT TO COMBINE BOTH OF THEM BUT DON'T USE TRANSACTION COMMAND.</P> Mon, 14 Nov 2016 20:33:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-fields-to-one-field/m-p/219979#M64659 prashanthberam 2016-11-14T20:33:52Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-fields-to-one-field/m-p/219980#M64660 <P>try this:</P> <PRE><CODE>... | eval timestamp = coalesce(timestamp1, timestamp2) </CODE></PRE> Mon, 14 Nov 2016 20:37:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-fields-to-one-field/m-p/219980#M64660 martin_mueller 2016-11-14T20:37:21Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-fields-to-one-field/m-p/219981#M64661 <P>NO AM NOT GETTING THE RESULT WAS SAME IN FACT AM LOSING THE ONE COLUMN</P> Mon, 14 Nov 2016 20:40:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-fields-to-one-field/m-p/219981#M64661 prashanthberam 2016-11-14T20:40:45Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-fields-to-one-field/m-p/219982#M64662 <P>No need to shout!</P> Mon, 14 Nov 2016 20:40:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-fields-to-one-field/m-p/219982#M64662 ChrisG 2016-11-14T20:40:52Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-fields-to-one-field/m-p/219983#M64663 <P>Give this a try</P> <PRE><CODE>your base search | stats values(TIMESTAMP1) as TIMESTAMP1 values(TIMESTAMP2) as TIMESTAMP2 by ID </CODE></PRE> Mon, 14 Nov 2016 20:43:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-fields-to-one-field/m-p/219983#M64663 somesoni2 2016-11-14T20:43:48Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-fields-to-one-field/m-p/219984#M64664 <P>it's worked perfectly thank you so much somesh...</P> Mon, 14 Nov 2016 20:51:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-fields-to-one-field/m-p/219984#M64664 prashanthberam 2016-11-14T20:51:47Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-fields-to-one-field/m-p/219985#M64665 <P>you didn't specify what result you wanted, and this combines the two fields into one field as you requested.</P> <P>somesh's answer you accepted combines two rows into one row. be more specific in your question.</P> Mon, 14 Nov 2016 20:55:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-fields-to-one-field/m-p/219985#M64665 martin_mueller 2016-11-14T20:55:24Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-fields-to-one-field/m-p/219986#M64666 <P>actually single id am getting 1 column empty and other column have the value<BR /> in the same way id no 1 has another row that is also the same </P> <P>so i want to dis play like this </P> <P>1 210 201<BR /> 2 310 310<BR /> 3 410 450</P> <P>like this .... </P> Mon, 14 Nov 2016 20:59:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-fields-to-one-field/m-p/219986#M64666 prashanthberam 2016-11-14T20:59:39Z