Splunk Search

How to combine two field results into single field permanently ?

navd
New Member

Lets say I have extracted two fields rs_time1 and rs_time2. But now, I want to merge the values from these fields to one single field called rs_time . I have the following query, which does correctly what I wanted in search time , but is there a way to do it permanently rather than during search time ?

| eval "rs_time"=coalesce(rs_time1,rs_time2)
|stats avg(rs_time) as res_time
0 Karma

marycordova
SplunkTrust
SplunkTrust
  1. please post a sample of the data
  2. are the fields rs_time1 and rs_time2 always present in all events, mutually exclusive, or sometimes both, sometimes one of them, and sometimes neither?
  3. are you performing the extraction or are they naturally identified fields by Splunk?

assuming Splunk is identifying the fields and that you have not manually extracted them:

in props.conf

[sourcetype]
EVAL-rs_time = if(isnotnull('rs_time1'),'rs_time1','rs_time2')
0 Karma

nick405060
Motivator

If the data comes from a heavy forwarder, you can use transforms.conf to create the merged field before the data is ingested to your indexers

0 Karma

pyro_wood
SplunkTrust
SplunkTrust

Hey @navd,

sure it's possible and you already have the right strategy with the coalesce command.

I posted you a link about Calculated Fields that will help you further.

http://docs.splunk.com/Documentation/Splunk/7.1.2/Knowledge/definecalcfields

Tell us if you need further assistance.

0 Karma

pyro_wood
SplunkTrust
SplunkTrust

@navd,

did this help you?

0 Karma