Splunk Search

Add values to the end of table

Abarny
Path Finder

Hi guys,

Can you tell me if is it possible to add a values on fields to the end of a table to an other fields

Exemple:
For moment I have that

TitreInit            TitileNew
Title 1            Title 7
                      Title 6
                      Title 5
                      Title 4
                      Title 3
                      Title 2

And i want this :

Title 

Title 7
Title 6
Title 5
Title 4
Title 3
Title 2
Title 1

I do this request :

index="gta_projets"
|fields logs{}.projectId, logs{}.newTitle  
|rename logs{}.projectId as "NOVA ID"
|join [|search index="gtav2_projects"  projects{}.icma="xxx" 
|fields projects{}.title, projects{}.id 
| rename projects{}.id  as "NOVA ID" ]
| stats values(projects{}.title) as TitreInit, list(logs{}.newTitle) as TitileNew
0 Karma
1 Solution

3no
Communicator

You're looking for coalesce command.

Add this at the end of your request :

|eval Title = coalesce(TitreInit,TitileNew) | table Title

View solution in original post

3no
Communicator

You're looking for coalesce command.

Add this at the end of your request :

|eval Title = coalesce(TitreInit,TitileNew) | table Title

Abarny
Path Finder

Thanks you !

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...