Good Afternoon,
I am working on a coalesce query that looks like this:
| makeresults
| eval Name="John", NAME="Johnny", name="john"
| eval New_Name=coalesce("Name:;"+Name, "NAME:;"+NAME, "name:;"+name)
| rex mode=sed field=New_Name "s/;/\n/g"
| table New_Name
The output I get is exactly what I'm looking for but is there a way I can simplify this? I'm trying to have the table display the field name with the coalesced value without having to type in the string before the value (ie: "Name:;"+Name). Any help would be greatly appreciated.
Respectfully,
Jayson
| makeresults
| eval Name="John", NAME="Johnny", name="john"
| foreach *
[eval <<FIELD>>="<<FIELD>>:;".<<FIELD>>]
| eval New_Name=coalesce(Name, NAME, name)
| rex mode=sed field=New_Name "s/;/\n/g"
| table New_Name
This is perfect. Thank you.
| makeresults
| eval Name="John", NAME="Johnny", name="john"
| foreach *
[eval <<FIELD>>="<<FIELD>>:;".<<FIELD>>]
| eval New_Name=coalesce(Name, NAME, name)
| rex mode=sed field=New_Name "s/;/\n/g"
| table New_Name