Knowledge Management

Why does alias not always work as expected?

marcus_doron
New Member

In my Results, for each event, I can only get field A OR field B.
I created two aliases: A=C, B=C
So each event should have C with a value.

But in the result, I can see that sometimes C gets value A, sometimes value B, and sometimes Blank.

Tags (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi marcus_doron,
If you have only one of the three field with value or if you have an order of importance in your fields, you could use the coalesce function:

| eval C=coalesce(C,A,B)

in this way your C field take value, in order, from C, A, B.

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...

Introducing New Splunkbase Governance!

Splunk apps are essential for maximizing the value of your Splunk Experience. Whether you’re using the default ...

3 Ways to Make OpenTelemetry Even Better

My role as an Observability Specialist at Splunk provides me with the opportunity to work with customers of ...