Extract value from multiple events that have different fields?

[pmcfadden91]

Below is my query which list about 80 events grouped by a certain ID (488e5185-42d7-4eec-bcb5-43590ae751a0).
The events have different field names for the same ID (ASAPLocateID, TransID, locate, clientLocateId domain="GLR">488e5185-42d7-4eec-bcb5-43590ae751a0</ns0:clientLocateId). How can I extract this ID and any others into a field regardless of the different host, source, or sourcetype?

index="gfs_cft_neo" OR index="gfs_sbl_al" source!="*performance*" "488e5185-42d7-4eec-bcb5-43590ae751a0"| reverse | streamstats window=1 global=f current=t first(source) as p_source count as Transition | eval transition_time = if(p_source == source, _time, -1 ) | where transition_time > -1 | streamstats count as Transition | delta transition_time AS transition_duration | rex field=source ".*/(?<Component>.*).log"| table Transition, Component, transition_duration

[woodcock · Accepted solution]

With the coalesce command, like this:

index="gfs_cft_neo" OR index="gfs_sbl_al" source!="performance" "488e5185-42d7-4eec-bcb5-43590ae751a0"| eval NormalizedID=coalesce(ASAPLocateID, TransID, locate, clientLocateId)

Then you do your downstream work with NormalizedID.