Lets say I have extracted two fields rs_time1 and rs_time2. But now, I want to merge the values from these fields to one single field called rs_time . I have the following query, which does correctly what I wanted in search time , but is there a way to do it permanently rather than during search time ?
| eval "rs_time"=coalesce(rs_time1,rs_time2)
|stats avg(rs_time) as res_time