Splunk Search
Highlighted

Can I rename different fields the same thing?

Communicator

I'm working with a dataset that lists companies and individual people, so that some entries have the field "Entity Name" and some have "Individual Name". I'd like to output a table with both of these fields shown under a single "Name" field. When I try to rename them both by this title, though, the second command overwrites the first one. Is there a way to have both fields listed under the same title, while keeping them as separate events?

Tags (3)
Highlighted

Re: Can I rename different fields the same thing?

Motivator

I often use coalesce in these cases; hopefully it will work in yours.

... | eval name = coalesce(entityName, individualName) | ... 

This assumes every event will have either one or the other field. Otherwise I think if it has both it will grab the fields in the order listed. I often use that for especially Windows logs where the field used might be different for the same type of event based on OS version or specific event ID.

View solution in original post

Highlighted

Re: Can I rename different fields the same thing?

Motivator

Another way to do it might be something like

... | eval name = if(isnotnull(entityName), entityName, individualName) | ...
0 Karma
Highlighted

Re: Can I rename different fields the same thing?

Builder

Hi,
Try this

...|rename "Entity Name"  as EntityName| rename "Individual Name"  as IndividualName |eval name=EntityName  +  IndividualName |...
Highlighted

Re: Can I rename different fields the same thing?

Motivator

u can try like this:
... |rename entityName as Name |eval Name ="companie name:" + Name + "and people name:" + individualName | ...

Highlighted

Re: Can I rename different fields the same thing?

Hi Federica_92,

I the following can solve your problem:

.........|eval SingleName=mvzip(entityName, individualName)| makemv delim="," SingleName|mvexpand SingleName

For Example if you want to have both host and soure in the same field call SingleName :

index=*|table host source|eval SingleName=mvzip(host,source)| makemv delim="," SingleName|mvexpand SingleName

I hope you will be satisfied.