How to combine similar values into one table column

[aristidiskantas]

Hello everyone, 

I am having two events with different sourcetypes that have similar fields with similar values however not the same.

I have found a way to combine the fields by using coalesce, however I would like to combine the values as well in order to get a clear result

I am running this search :

index="main" category="Foo" OR sourcetype="foo" 
| iplocation ip_address 
| eval severity_level = coalesce(severity, foo_severity)
| geostats count by severity_level

and I am having the following results. 

| longitude | latitude | HIGH | High | MEDIUM | Medium | LOW | Low |
|  143.2104 | -33.494  |  39  |  4   |   40   |   30   |  15 |  5  |

 
And I want to get something like:

| longitude | latitude | HIGH  | MEDIUM | LOW | 
|  143.2104 | -33.494  |  43   |   70   |  20 |

 
Could you please give a hint? Thank you very much in advance.

[gcusello · Accepted solution]

Hi @aristidiskantas,

you have to convert all values in upper or lower case, something like this:

index="main" category="Foo" OR sourcetype="foo" 
| iplocation ip_address 
| eval severity_level = upper(coalesce(severity, foo_severity))
| geostats count by severity_level

Ciao.

Giuseppe

[aristidiskantas]

That worked! Thank you so mush for the input Giuseppe. 

Wish you the best,

Aris

[gcusello]

Hi @aristidiskantas,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated ;-