Coalesce Function

[IRHM73]

Hi, I wonder whether someone may be able to help me please.

I've been reading the Splunk documentation on the 'coalesce' function and understand the principals of this.

The example in the Splunk documentation highlights this scenario:

Let's say you have a set of events
where the IP address is extracted to
either clientip or ipaddress. This
example defines a new field called ip,
that takes the value of either
clientip or ipaddress, depending on
which is not NULL (exists in that
event): ... | eval
ip=coalesce(clientip,ipaddress)

Could someone tell me please, how I would be able to amend this to look for a speciifc ip address.

Many thanks and kind regards

Chris

[sundareshr · Accepted solution]

Not sure I understand your question... In the above example, you will not have 3 fields clientip, ipaddress and the newly created ip. if you just looking to search for a specific ip address after the coalesce command, you could do ..|search ip=<> or you could do the same without the coalesce ..| search (clientip=<> OR ipaddress=<>). Coalesce is useful when you want to transform the data ..| stats count ip by host when you need all the ip address information in one field.

[IRHM73]

Hi @sundareshr, thank you very much for this explanation, it's really very useful.

Kind Regards

Chris

[jkat54]

Right, but you would search for the IP address prior to running coalesce to reduce the overhead and resource usage of coalesce.

192.168.0.1 | ...

[IRHM73]

HI @jkat54, thank you very much for the explanation, really very useful.

Kind Regards

Chris