Combine Like Fields from Sourcetypes in the Same Index

[atebysandwich]

I have two sourcetypes from the same index, both in JSON formatting.  One contains hosts and vulnerability scan data and the other contains hosts and host info. I ultimately want to tie the vulnerability data to the the hosts in the other sourcetype and create an outputlookup.

The matching field I would like to use is IP but the field names are different in each sourcetype. Sourcetype1 has the IP field named ipv4s{} and sourcetype2's IP field is called asset.ivp4. I have tried combing them using eval and coalesce but when I do, ipv4s{} will come up as the field value and not the IPs of the two previously mentioned fields. 

Here is the search I've been trying:

index=index (sourcetype=sourcetype1 OR sourcetype=sourcetype2
| eval IP=coalesce("ipv4s{}","asset.ipv4")

[yuanliu]

The big secret is quotation marks.

index=index (sourcetype=sourcetype1 OR sourcetype=sourcetype2
| eval IP=coalesce('ipv4s{}','asset.ipv4')

[isoutamo]

In splunk ” means value and ‘ means field name.