How to combine two field results into single field permanently ?

[navd]

Lets say I have extracted two fields rs_time1 and rs_time2. But now, I want to merge the values from these fields to one single field called rs_time . I have the following query, which does correctly what I wanted in search time , but is there a way to do it permanently rather than during search time ?

| eval "rs_time"=coalesce(rs_time1,rs_time2)
|stats avg(rs_time) as res_time

[marycordova]

1. please post a sample of the data
2. are the fields rs_time1 and rs_time2 always present in all events, mutually exclusive, or sometimes both, sometimes one of them, and sometimes neither?
3. are you performing the extraction or are they naturally identified fields by Splunk?

assuming Splunk is identifying the fields and that you have not manually extracted them:

in props.conf

[sourcetype]
EVAL-rs_time = if(isnotnull('rs_time1'),'rs_time1','rs_time2')

[nick405060]

If the data comes from a heavy forwarder, you can use transforms.conf to create the merged field before the data is ingested to your indexers

[horsefez]

Hey @navd,

sure it's possible and you already have the right strategy with the coalesce command.

I posted you a link about Calculated Fields that will help you further.

http://docs.splunk.com/Documentation/Splunk/7.1.2/Knowledge/definecalcfields

Tell us if you need further assistance.

[horsefez]

@navd,

did this help you?