Splunk Search

Coalesce Function

IRHM73
Motivator

Hi, I wonder whether someone may be able to help me please.

I've been reading the Splunk documentation on the 'coalesce' function and understand the principals of this.

The example in the Splunk documentation highlights this scenario:

Let's say you have a set of events
where the IP address is extracted to
either clientip or ipaddress. This
example defines a new field called ip,
that takes the value of either
clientip or ipaddress, depending on
which is not NULL (exists in that
event): ... | eval
ip=coalesce(clientip,ipaddress)

Could someone tell me please, how I would be able to amend this to look for a speciifc ip address.

Many thanks and kind regards

Chris

1 Solution

sundareshr
Legend

Not sure I understand your question... In the above example, you will not have 3 fields clientip, ipaddress and the newly created ip. if you just looking to search for a specific ip address after the coalesce command, you could do ..|search ip=<> or you could do the same without the coalesce ..| search (clientip=<> OR ipaddress=<>). Coalesce is useful when you want to transform the data ..| stats count ip by host when you need all the ip address information in one field.

View solution in original post

sundareshr
Legend

Not sure I understand your question... In the above example, you will not have 3 fields clientip, ipaddress and the newly created ip. if you just looking to search for a specific ip address after the coalesce command, you could do ..|search ip=<> or you could do the same without the coalesce ..| search (clientip=<> OR ipaddress=<>). Coalesce is useful when you want to transform the data ..| stats count ip by host when you need all the ip address information in one field.

IRHM73
Motivator

Hi @sundareshr, thank you very much for this explanation, it's really very useful.

Kind Regards

Chris

0 Karma

jkat54
SplunkTrust
SplunkTrust

Right, but you would search for the IP address prior to running coalesce to reduce the overhead and resource usage of coalesce.

192.168.0.1 | ...

0 Karma

IRHM73
Motivator

HI @jkat54, thank you very much for the explanation, really very useful.

Kind Regards

Chris

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...