Hello folks,
Trying to figure out how to go about joining 2 fields with a dash but only if they don't have the same values. Ideally, if there's a way to dynamically add the - only if 2 strings, that would cool!
string1 string2 string3
string10 string20 string20
string11 string100 string100
index=xyz sourcetype=zzz |table field1 field2 field3
|eval joined = field2 + " - " + field3
|table field1 joined
Results desired for joined field
string1 string2 - string3
string10 string20
string11 string100
Like this:
index=xyz sourcetype=zzz | eval joined=if((field2!=field3), field2 . "-" . field3, null())
Like this:
index=xyz sourcetype=zzz | eval joined=if((field2!=field3), field2 . "-" . field3, null())