Can I rename different fields the same thing?

[Federica_92]

I'm working with a dataset that lists companies and individual people, so that some entries have the field "Entity Name" and some have "Individual Name". I'd like to output a table with both of these fields shown under a single "Name" field. When I try to rename them both by this title, though, the second command overwrites the first one. Is there a way to have both fields listed under the same title, while keeping them as separate events?

[Robwhoa78]

What if you have multiple that you want to rename the same?

| rename "Message.TaskInfo.CarHop Backup.LastResult"="-2147020576" AS Result
| rename "Message.TaskInfo.CarHop Backup.LastResult"=1 AS Result
| rename "Message.TaskInfo.CarHop Backup.LastResult"=0 AS Result
| rename "Message.TaskInfo.AI Restart Weekly.LastResult"=267011 AS Result
| rename "Message.TaskInfo.CarHop Backup.LastResult"=267009 AS Result
| rename "Message.TaskInfo.CarHop Backup.LastResult"=2 AS Result

This is not working for me

[stephane_cyrill]

Hi Federica_92,

I the following can solve your problem:

.........|eval SingleName=mvzip(entityName, individualName)| makemv delim="," SingleName|mvexpand SingleName

For Example if you want to have both host and soure in the same field call SingleName :

index=*|table host source|eval SingleName=mvzip(host,source)| makemv delim="," SingleName|mvexpand SingleName

I hope you will be satisfied.

[fdi01]

u can try like this:
... |rename entityName as Name |eval Name ="companie name:" + Name + "and people name:" + individualName | ...

[NOUMSSI]

Hi,
Try this

...|rename "Entity Name"  as EntityName| rename "Individual Name"  as IndividualName |eval name=EntityName  +  IndividualName |...

[Runals · Accepted solution]

I often use coalesce in these cases; hopefully it will work in yours.

... | eval name = coalesce(entityName, individualName) | ... 

This assumes every event will have either one or the other field. Otherwise I think if it has both it will grab the fields in the order listed. I often use that for especially Windows logs where the field used might be different for the same type of event based on OS version or specific event ID.

[Runals]

Another way to do it might be something like

... | eval name = if(isnotnull(entityName), entityName, individualName) | ...