How to replace a field value with a value from another field?

[spectrum2035]

In paloalto app, we do have a field named url which pickup the fields that comes after tcp,alert, first log looks good

url - *.azure-api.net/

Jun 18 14:42:43 abc-gyhe-icf-01.babcb.com 1,2019/06/18 14:42:43,007801000313,THREAT,url,1,2019/06/18 14:42:43,10.72.150.187,113.69.17.26,90.26.14.16,113.169.117.26,Global Protection,,,ssl,vsys1,Trusted,Untrusted,ae2.3003,ae2.3002,panorama,2019/06/18 14:42:43,349294,1,58019,443,50807,443,0x40b000,tcp,alert,"*.azure-api.net/",(9999),computer-and-internet-info,informational,client-to-server,91978567206,0x0,BabcB Network,NL,0,,0,,,0,,,,,,,,0,12,0,0,0,vsys1,abc-gyhhe-icffw-01,

On the second log, for url field, instead of picking up the field after the tcp,alert we would like to pick up the last field in the logs

so url will be:

"s3-dub-2.cf.dash.row.aiv-cdn.net/dm/2$Cfg5p5P7MkB10_Y_-jDa5eJVhPA~/5abc/bec6/d93c/4b2d-b63e-dd67f2299891/3910562d-561d-413a-956c-b2693087a939_audio_9.mp4" instead of "3910562d-561d-413a-956c-b2693087a939_audio_9.mp4"

Only to 1% of the logs is having this issue.

Jun 18 14:39:22 abc-gyhe-icf-01.abcd.com 1,2019/06/18 14:39:21,007801000313,THREAT,file,1,2019/06/18 14:39:21,154.12.198.11,10.154.24.93,154.12.198.11,90.26.14.14,Global Protection,,,http-video,vsys1,Untrusted,Trusted,ae2.3002,ae2.3003,panorama,2019/06/18 14:39:21,398284,2,80,41187,80,37494,0x402000,tcp,alert,"3910562d-561d-413a-956c-b2693087a939_audio_9.mp4",MP4 Detected(52104),computer-and-internet-info,low,server-to-client,91978264214,0x0,US,BabcB Network,0,,0,,,206,,,,,,,,0,12,0,0,0,vsys1,abc-gyhhe-icffw-01,s3-dub-2.cf.dash.row.aiv-cdn.net/dm/2$Cfg5p5P7MkB10_Y_-jDa5eJVhPA~/5abc/bec6/d93c/4b2d-b63e-dd67f2299891/3910562d-561d-413a-956c-b2693087a939_audio_9.mp4

[VatsalJagani]

Could you please tell how you distinguish between first event and second event?

[spectrum2035]

first field is picked as url and second field is picked as future_use5

[snowmizer · Accepted solution]

Does every event have tcp,alert? If not (or there's some other distinguishing factor between events) then you could extract the two fields into separate fields and then use eval coalesce command to combine them into one field.

Example:

eval url=coalesce(fielda,fieldb)

Info on the coalesce command: https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/ConditionalFunctions#coalesce.28X...

[spectrum2035]

Thanks a lot.