Splunk Search

How to combine two field results into single field permanently ?

New Member

Lets say I have extracted two fields rstime1 and rstime2. But now, I want to merge the values from these fields to one single field called rs_time . I have the following query, which does correctly what I wanted in search time , but is there a way to do it permanently rather than during search time ?

| eval "rs_time"=coalesce(rs_time1,rs_time2)
|stats avg(rs_time) as res_time
0 Karma

SplunkTrust
SplunkTrust
  1. please post a sample of the data
  2. are the fields rstime1 and rstime2 always present in all events, mutually exclusive, or sometimes both, sometimes one of them, and sometimes neither?
  3. are you performing the extraction or are they naturally identified fields by Splunk?

assuming Splunk is identifying the fields and that you have not manually extracted them:

in props.conf

[sourcetype]
EVAL-rs_time = if(isnotnull('rs_time1'),'rs_time1','rs_time2')
0 Karma

Motivator

If the data comes from a heavy forwarder, you can use transforms.conf to create the merged field before the data is ingested to your indexers

0 Karma

SplunkTrust
SplunkTrust

Hey @navd,

sure it's possible and you already have the right strategy with the coalesce command.

I posted you a link about Calculated Fields that will help you further.

http://docs.splunk.com/Documentation/Splunk/7.1.2/Knowledge/definecalcfields

Tell us if you need further assistance.

0 Karma

SplunkTrust
SplunkTrust

@navd,

did this help you?

0 Karma