Splunk Search

How to combine the output of 2 different fields into one single field?

snix
Communicator

I have two fields I would like to combine into one field.

  field1      |    field2    |      combined field
1.    Bob                                      Bob
2.                   Jeff                     Jeff
3.                   Jack                     Jack
4.    Frank                                   Frank

Only one field is ever populated at any one time so it is a bit redundant to have two fields that hold very similar information. These should just be combined into a single field.

0 Karma
1 Solution

snix
Communicator

Okay just found the answer on this post:
https://answers.splunk.com/answers/432887/how-to-combine-common-fields-from-search-results-i.html?ut...

This is the line I needed to get the output I am looking for:
eval "New Field Name"=coalesce(field1,field2)

View solution in original post

justinw
Explorer

If you always want the two fields to be combined, and they won't both be populated at once, you could make a field alias to rename field1 as field2 or vice versa. May be a slightly more useful/easy solution if it applies.

0 Karma

snix
Communicator

Okay just found the answer on this post:
https://answers.splunk.com/answers/432887/how-to-combine-common-fields-from-search-results-i.html?ut...

This is the line I needed to get the output I am looking for:
eval "New Field Name"=coalesce(field1,field2)

aaraneta_splunk
Splunk Employee
Splunk Employee

@snix - Glad you found the answer to your question. Please don't forget to "Accept" your answer to resolve this post so that others can easily find it, in case they run into the same type of problem. Thanks.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...