I have two fields I would like to combine into one field.
field1 | field2 | combined field
1. Bob Bob
2. Jeff Jeff
3. Jack Jack
4. Frank Frank
Only one field is ever populated at any one time so it is a bit redundant to have two fields that hold very similar information. These should just be combined into a single field.
Okay just found the answer on this post:
https://answers.splunk.com/answers/432887/how-to-combine-common-fields-from-search-results-i.html?ut...
This is the line I needed to get the output I am looking for:
eval "New Field Name"=coalesce(field1,field2)
If you always want the two fields to be combined, and they won't both be populated at once, you could make a field alias to rename field1 as field2 or vice versa. May be a slightly more useful/easy solution if it applies.
Okay just found the answer on this post:
https://answers.splunk.com/answers/432887/how-to-combine-common-fields-from-search-results-i.html?ut...
This is the line I needed to get the output I am looking for:
eval "New Field Name"=coalesce(field1,field2)
@snix - Glad you found the answer to your question. Please don't forget to "Accept" your answer to resolve this post so that others can easily find it, in case they run into the same type of problem. Thanks.