Bulk rename fields by regex pattern

[Cuyose]

Basically I have a bunch of fields that are coming in foo.date.blah, where date is dynamic and the foo and blah are static.

I want to basically just coalesce or bulk rename these all into a field labeled foo.blah.

[somesoni2]

Give this a try

Your current search giving all fool.<date>.blah type fields
| eval "foo.blah"=null() | foreach foo.*.blah [| eval "foo.blah"=coalesce('<<FIELD>>','foo.blah')]

See this runanywhere sample (instead of dates I used numbers but should work the same way for dates)

| gentimes start=-1 | eval "foo.12.blah"=1 | table foo* | append [| gentimes start=-1 | eval "foo.13.blah"=2 | table foo*]  | append [| gentimes start=-1 | eval "foo.14.blah"=3 | table foo*]
| eval "foo.blah"=null() | foreach foo.*.blah [| eval "foo.blah"=coalesce('<<FIELD>>','foo.blah')]

[Cuyose]

For whatever reason, this still is not working. Your example works, however replacing verbatim the foo and bar sections with my own data fails to parse out the information.

[niketn]

@Cuyose some sample field names and their values per event would help us assist you better.
Why you need coalesce()? What if multiple date fields are not null but are different?

[Cuyose]

The field names are as follows
codeDropUploadMap.20180828..qcTickets
codeDropUploadMap.20180711..qcTickets
codeDropUploadMap.20180804..qcTickets
etc.

The data contained within is a comma delimited string of id's. each row only has values for one of the columns, if any.

I used your format to do something similar with another field and it worked fine. I think it might have to do with the data within?

[sudosplunk]

There's a possibility of doing this by rex. Can you provide some sample events?