Changing field names at runtime

[mmmmssss]

Hi,

I cant find a good way to rename multiple field names within different datatypes at run time to then be able to apply transactions to them.

Here is an example:

search * | rename SourceNetworkAddress as IP | stats count by IP

This gives me 4 different IP's with 39 distinct events

if I change it to

search * | rename SourceNetworkAddress as IP, IP_Address as IP | stats count by IP

The second value seems to overwrite the first and I end up with 2 different IP addresses with 12 distinct events. I guess because the first event type doesnt contain that fieldname it is just being overwritten to blank.

I have got around it in the interim by just renaming the first field to the name of the second, but this isnt flexible as I now want to add a third datatype.

Any help appreciated! Thanks,

[Ayn · Accepted solution]

You could use eval's coalesce() function instead. It will take a variable number of parameters and return the first one that is not null.

search * | eval IP=coalesce(SourceNetworkAddress, IP_Address, ..., ...) | stats count by IP