Getting Data In
Highlighted

How to handle a field alias for two fields in search results when the source type is the same?

Communicator

We have data which can display a computer's serial number. The data is a little odd and we have to extract the serial number using 1 rex and 1 is done automatically. This creates 2 fields serialnumber1 & serialnumber2 .

I've tried to create an alias called serialnumber, but I've run into problems.

Applies to sourcetype = imap
Field aliases >  serialnumber1 =serialnumber
Field aliases >  serialnumber2 =serialnumber

The problem is that when both fields are populated, serialnumber is populated

1. When serialnumber1 is NULL and serialnumber2 is populated, "serialnumber" is populated
2. When serialnumber1 is populated and serialnumber2 is NULL,"serialnumber" IS NOT POPULATED
3. When Both serialnumber1 & serialnumber2 are populated, "serialnumber" is populated

Why is this case that when search result 2. above is true the aliases fail.

0 Karma
Highlighted

Re: How to handle a field alias for two fields in search results when the source type is the same?

Legend

Hi arrowecssupport,
if you can fix a priority in fields use, you could you coalesce function:
| eval serialnumber=coalesce(serialnumber1,serialnumber2)

Bye.
Giuseppe

0 Karma
Highlighted

Re: How to handle a field alias for two fields in search results when the source type is the same?

Communicator

Thanks that appears to work and might work in some situations.
Problem is want to be able to create a search into an Event type and this isn't possible when you use a pipe.

0 Karma
Highlighted

Re: How to handle a field alias for two fields in search results when the source type is the same?

Esteemed Legend

If it is an eventtype then you can obscure the fact that there are 2 fields by making it use the search serialnumber1="MyValue" OR serialnumber2="MyValue". Then you can access it through a macro that adds the coalesce command so your search would be:

`MyMacro` | rest of your search
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.