COALESCE command

[jip31]

hi
when I execute the query below

index="x" sourcetype="WinEventLog:Microsoft-Windows-Diagnostics-Performance/Operational"

I can display a field called "OpCode". This fields has many values and I want to display one of them
sometimes this field is in english, sometimes in french, sometimes in spain and sometimes in german
so I need to use "coalesce" like this

| eval 'Boot_Degradation'=coalesce('Boot_Degradation','Détérioration du démarrage','Información del arranque','Startbeeinträchtigung') 
| table OpCode

but it doesnt works
could you help me please???

[vnravikumar]

It looks duplicate of

https://answers.splunk.com/answers/726556/help-on-coalesce-command.html

[gouravdashtcs]

Hello Jip31,

Coalesce command is used to combine two or different fields from different or same sourcetype to perform further action.

Kindly try to modify the above SPL and try to run.

| eval 'Gen_OpCode'=coalesce('Boot_Degradation','Détérioration du démarrage','Información del arranque','Startbeeinträchtigung')
|table Gen_OpCode