https://community.splunk.com/t5/Splunk-Search/How-to-combine-the-output-of-2-different-fields-into-one-single/m-p/318085#M95167 <P>If you always want the two fields to be combined, and they won't both be populated at once, you could make a field alias to rename field1 as field2 or vice versa. May be a slightly more useful/easy solution if it applies.</P> Fri, 09 Mar 2018 20:03:05 GMT justinw 2018-03-09T20:03:05Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-the-output-of-2-different-fields-into-one-single/m-p/318082#M95164 <P>I have two fields I would like to combine into one field. </P> <PRE><CODE> field1 | field2 | combined field 1. Bob Bob 2. Jeff Jeff 3. Jack Jack 4. Frank Frank </CODE></PRE> <P>Only one field is ever populated at any one time so it is a bit redundant to have two fields that hold very similar information. These should just be combined into a single field.</P> Fri, 24 Feb 2017 18:14:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-the-output-of-2-different-fields-into-one-single/m-p/318082#M95164 snix 2017-02-24T18:14:28Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-the-output-of-2-different-fields-into-one-single/m-p/318083#M95165 <P>Okay just found the answer on this post:<BR /> <A href="https://answers.splunk.com/answers/432887/how-to-combine-common-fields-from-search-results-i.html?utm_source=typeahead&amp;utm_medium=newquestion&amp;utm_campaign=no_votes_sort_relev">https://answers.splunk.com/answers/432887/how-to-combine-common-fields-from-search-results-i.html?utm_source=typeahead&amp;utm_medium=newquestion&amp;utm_campaign=no_votes_sort_relev</A></P> <P>This is the line I needed to get the output I am looking for:<BR /> <CODE>eval "New Field Name"=coalesce(field1,field2)</CODE></P> Fri, 24 Feb 2017 18:19:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-the-output-of-2-different-fields-into-one-single/m-p/318083#M95165 snix 2017-02-24T18:19:58Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-the-output-of-2-different-fields-into-one-single/m-p/318084#M95166 <P>@snix - Glad you found the answer to your question. Please don't forget to "Accept" your answer to resolve this post so that others can easily find it, in case they run into the same type of problem. Thanks.</P> Fri, 24 Feb 2017 18:31:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-the-output-of-2-different-fields-into-one-single/m-p/318084#M95166 aaraneta_splunk 2017-02-24T18:31:02Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-the-output-of-2-different-fields-into-one-single/m-p/318085#M95167 <P>If you always want the two fields to be combined, and they won't both be populated at once, you could make a field alias to rename field1 as field2 or vice versa. May be a slightly more useful/easy solution if it applies.</P> Fri, 09 Mar 2018 20:03:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-the-output-of-2-different-fields-into-one-single/m-p/318085#M95167 justinw 2018-03-09T20:03:05Z