I'm working with a dataset that lists companies and individual people, so that some entries have the field "Entity Name" and some have "Individual Name". I'd like to output a table with both of these fields shown under a single "Name" field. When I try to rename them both by this title, though, the second command overwrites the first one. Is there a way to have both fields listed under the same title, while keeping them as separate events?
I often use coalesce in these cases; hopefully it will work in yours.
... | eval name = coalesce(entityName, individualName) | ...
This assumes every event will have either one or the other field. Otherwise I think if it has both it will grab the fields in the order listed. I often use that for especially Windows logs where the field used might be different for the same type of event based on OS version or specific event ID.
Another way to do it might be something like
... | eval name = if(isnotnull(entityName), entityName, individualName) | ...
...|rename "Entity Name" as EntityName| rename "Individual Name" as IndividualName |eval name=EntityName + IndividualName |...
u can try like this:
... |rename entityName as Name |eval Name ="companie name:" + Name + "and people name:" + individualName | ...
I the following can solve your problem:
.........|eval SingleName=mvzip(entityName, individualName)| makemv delim="," SingleName|mvexpand SingleName
For Example if you want to have both host and soure in the same field call SingleName :
index=*|table host source|eval SingleName=mvzip(host,source)| makemv delim="," SingleName|mvexpand SingleName
I hope you will be satisfied.