Aggregating by fields when not all events have the same fields

[skippylou]

Trying to figure out how to aggregate with top when there are two field choices.

Here's an example of what I am trying:

Basically I have events that have either field1 OR field2. The events that have field1 also have a field called event1_type, the events that have field2 have a field called event2_type.

So I have the following search: (field1 > 5 OR field2 = 1). This works great. Normally if I was doing a single field search I would then '| top event_type'. Since the events have one of two event_type choices I'm not sure how to aggregate with top the event{1,2}_type values.

Any help is much appreciated.

Scott

[gkanapathy · Accepted solution]

I guess I would consider evaling a new field using coalesce():

field1 > 5 OR field2 = 1 | eval e_type=coalesce(event1_type,event2_type) | top e_type

If you're before 4.1, coalesce(x,y) is just if(isnotnull(x),x,y).

[skippylou]

Thanks! That worked perfectly!