Distinct Count of Field1 and field2

[heamik]

I am trying to get a distinct count of tacking id from all of our production indexes. The issue I am running into is that for internal indexes my field of interest is named "trackingid" and for external indexes the field is named "trackingId". 

I have tried several things and can only get values for either internal or external, and or both in separate columns. I cannot get both fields renamed as "tid". Which would then be split by region based on host.

[ITWhisperer · Accepted solution]

| eval trackingid=coalesce(trackingid,trackingId)

[heamik]

Thank you so much!!! That solved the problem perfectly!