Can I rename different fields the same thing?

[Federica_92]

I'm working with a dataset that lists companies and individual people, so that some entries have the field "Entity Name" and some have "Individual Name". I'd like to output a table with both of these fields shown under a single "Name" field. When I try to rename them both by this title, though, the second command overwrites the first one. Is there a way to have both fields listed under the same title, while keeping them as separate events?

[stephane_cyrill]

Hi Federica_92,

I the following can solve your problem:

.........|eval SingleName=mvzip(entityName, individualName)| makemv delim="," SingleName|mvexpand SingleName

For Example if you want to have both host and soure in the same field call SingleName :

index=*|table host source|eval SingleName=mvzip(host,source)| makemv delim="," SingleName|mvexpand SingleName

I hope you will be satisfied.

[fdi01]

u can try like this:
... |rename entityName as Name |eval Name ="companie name:" + Name + "and people name:" + individualName | ...

[NOUMSSI]

Hi,
Try this

...|rename "Entity Name"  as EntityName| rename "Individual Name"  as IndividualName |eval name=EntityName  +  IndividualName |...

[Runals · Accepted solution]

I often use coalesce in these cases; hopefully it will work in yours.

... | eval name = coalesce(entityName, individualName) | ... 

This assumes every event will have either one or the other field. Otherwise I think if it has both it will grab the fields in the order listed. I often use that for especially Windows logs where the field used might be different for the same type of event based on OS version or specific event ID.

[Runals]

Another way to do it might be something like

... | eval name = if(isnotnull(entityName), entityName, individualName) | ...