How do you store field names as values in a new field based on presence of that field?

[mpatel11]

Say I have 100 rows of logs. Some have only field "abcXYZ1" and not the other two. Some have field "abcKLM" and not the other two and so on...

So occurrence of fields "abc*" is mutually exclusive.

Now based on this, I want to add another field EVENT which will look if that log has field "abcXYZ1" then value of EVENT = abcXYZ1, if a log has field "abcKLM" then EVENT=abcKLM and so on...

So looking at a log and finding which type of field it has based on "abc*" , only that fields name will be stored as a value in the new field EVENT.

Hope it is clear to understand.

[kamlesh_vaghela]

@mpatel11

Please check my updated answer.

https://answers.splunk.com/answers/688878/how-do-you-store-multiple-similar-field-names-as-v.html

[mpatel11]

Updates answer also works like a charm. Thanks for the help..