Splunk Search

How to combine the output of 2 different fields into one single field?

snix
Communicator

I have two fields I would like to combine into one field.

  field1      |    field2    |      combined field
1.    Bob                                      Bob
2.                   Jeff                     Jeff
3.                   Jack                     Jack
4.    Frank                                   Frank

Only one field is ever populated at any one time so it is a bit redundant to have two fields that hold very similar information. These should just be combined into a single field.

0 Karma
1 Solution

snix
Communicator

Okay just found the answer on this post:
https://answers.splunk.com/answers/432887/how-to-combine-common-fields-from-search-results-i.html?ut...

This is the line I needed to get the output I am looking for:
eval "New Field Name"=coalesce(field1,field2)

View solution in original post

justinw
Explorer

If you always want the two fields to be combined, and they won't both be populated at once, you could make a field alias to rename field1 as field2 or vice versa. May be a slightly more useful/easy solution if it applies.

0 Karma

snix
Communicator

Okay just found the answer on this post:
https://answers.splunk.com/answers/432887/how-to-combine-common-fields-from-search-results-i.html?ut...

This is the line I needed to get the output I am looking for:
eval "New Field Name"=coalesce(field1,field2)

aaraneta_splunk
Splunk Employee
Splunk Employee

@snix - Glad you found the answer to your question. Please don't forget to "Accept" your answer to resolve this post so that others can easily find it, in case they run into the same type of problem. Thanks.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...