Splunk Search

Add values to the end of table

Abarny
Path Finder

Hi guys,

Can you tell me if is it possible to add a values on fields to the end of a table to an other fields

Exemple:
For moment I have that

TitreInit            TitileNew
Title 1            Title 7
                      Title 6
                      Title 5
                      Title 4
                      Title 3
                      Title 2

And i want this :

Title 

Title 7
Title 6
Title 5
Title 4
Title 3
Title 2
Title 1

I do this request :

index="gta_projets"
|fields logs{}.projectId, logs{}.newTitle  
|rename logs{}.projectId as "NOVA ID"
|join [|search index="gtav2_projects"  projects{}.icma="xxx" 
|fields projects{}.title, projects{}.id 
| rename projects{}.id  as "NOVA ID" ]
| stats values(projects{}.title) as TitreInit, list(logs{}.newTitle) as TitileNew
0 Karma
1 Solution

3no
Communicator

You're looking for coalesce command.

Add this at the end of your request :

|eval Title = coalesce(TitreInit,TitileNew) | table Title

View solution in original post

3no
Communicator

You're looking for coalesce command.

Add this at the end of your request :

|eval Title = coalesce(TitreInit,TitileNew) | table Title

Abarny
Path Finder

Thanks you !

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...