Splunk Search
Highlighted

How to create unique field names from two data sources that share a common field name?

Contributor

I have two data sources, each with a field named foo.
Each data source has a different sourcetype, so I'd like to do something like this:

(sourcetype=STa) OR (sourcetype=STb) | ...

if sourcetype is STa, I'd like to rename foo to fooA
if sourcetype is STb, I'd like to rename foo to fooB

Using eval fooA = coalesce(foo,NULL) works, but I'm not sure how to make it conditional so that it only acts on events with the STa sourcetype.

Thank you

0 Karma
Highlighted

Re: How to create unique field names from two data sources that share a common field name?

SplunkTrust
SplunkTrust

You can use the following technique:

eval fooA = if(sourcetype == "STa", foo, "")

And the same for fooB

View solution in original post

0 Karma
Highlighted

Re: How to create unique field names from two data sources that share a common field name?

Contributor

Thank you very much.

0 Karma
Highlighted

Re: How to create unique field names from two data sources that share a common field name?

SplunkTrust
SplunkTrust

IMO, the coalesce approach is what's needed here. It'll run for each event (for both sourcetypes) but so as any rename command.

0 Karma
Highlighted

Re: How to create unique field names from two data sources that share a common field name?

Contributor

I'd considered that, but wasn't quite sure how to place the coalesce into an "if" block

0 Karma