Splunk Search

How to combine the output of 2 different fields into one single field?

snix
Communicator

I have two fields I would like to combine into one field.

  field1      |    field2    |      combined field
1.    Bob                                      Bob
2.                   Jeff                     Jeff
3.                   Jack                     Jack
4.    Frank                                   Frank

Only one field is ever populated at any one time so it is a bit redundant to have two fields that hold very similar information. These should just be combined into a single field.

0 Karma
1 Solution

snix
Communicator

Okay just found the answer on this post:
https://answers.splunk.com/answers/432887/how-to-combine-common-fields-from-search-results-i.html?ut...

This is the line I needed to get the output I am looking for:
eval "New Field Name"=coalesce(field1,field2)

View solution in original post

justinw
Explorer

If you always want the two fields to be combined, and they won't both be populated at once, you could make a field alias to rename field1 as field2 or vice versa. May be a slightly more useful/easy solution if it applies.

0 Karma

snix
Communicator

Okay just found the answer on this post:
https://answers.splunk.com/answers/432887/how-to-combine-common-fields-from-search-results-i.html?ut...

This is the line I needed to get the output I am looking for:
eval "New Field Name"=coalesce(field1,field2)

aaraneta_splunk
Splunk Employee
Splunk Employee

@snix - Glad you found the answer to your question. Please don't forget to "Accept" your answer to resolve this post so that others can easily find it, in case they run into the same type of problem. Thanks.

0 Karma
Get Updates on the Splunk Community!

Fall Into Learning with New Splunk Education Courses

Every month, Splunk Education releases new courses to help you branch out, strengthen your data science roots, ...

Super Optimize your Splunk Stats Searches: Unlocking the Power of tstats, TERM, and ...

By Martin Hettervik, Senior Consultant and Team Leader at Accelerate at Iver, Splunk MVPThe stats command is ...

How Splunk Observability Cloud Prevented a Major Payment Crisis in Minutes

Your bank's payment processing system is humming along during a busy afternoon, handling millions in hourly ...