help on coalesce command with bad performances

[jip31]

Hi

I use the function coalesce but she has very bad performances because I have to query a huge number of host (50000)
I would like to find another solution in order to concatene a same field but which is unfortunately in different languages
could you help me please??

eventtype="toto 
| dedup host
| eval faulting_application_path=coalesce('Faulting application path','Chemin d’accès de l’application défaillante','Pfad der fehlerhaften Anwendung','Ruta de acceso de la aplicación con errores') 
| stats count as Errors by faulting_application_path 
| rename faulting_application_path as Application 
| sort -Errors limit=10

[nickhills · Accepted solution]

I have not tested this, but I think this should have the same effect:

eventtype="toto 
 | dedup host
 | rename 'Faulting application path' as Application, 'Chemin d’accès de l’application défaillante' as Application, 'Pfad der fehlerhaften Anwendung' as Application, 'Ruta de acceso de la aplicación con errores' as Application 
 | stats count as Errors by Application
 | sort -Errors limit=10