Hello Splunkers,
How can i rename all the OrderNumber1, OrderNumber2, OrderNumber3 as OrderNumber. And Country1, Country2,Country4 as Country. I have attached the screenshot also.
Appreciated in advance
@uagraw01 - Use the solution given by @gcusello if you want to get one value out of all the fields.
If you want all values from those fields into a new multi-valued field, then you can try:
| eval Country = mvappend(Country1, Country2, ...)
| eval OrderNumber = mvappend(OrderNumber1, OrderNumber2, ...)
I hope this helps!!
Hi @uagraw01 ,
if the field numbers is fixed, you can use coalesce option:
| eval OrderNumber=coalesce(OrderNumber1,OrderNumber2,OrderNumber3), country=coalesce(country1,country2,country3)
Ciao.
Giuseppe
@gcusello I already tried this. But let me know is this a good approach ?
@uagraw01 - You can use the same formula as part of props.conf EVAL statement as well.
@VatsalJagani I have some limitations here.