How to merge two field as sourcetype?

[rendie]

Hi,

I wanna merge two fields into sourcetype as below:

props.conf

[source::/path/to/folder/*]
sourcetype = coalesce(field1,field2)

So, as result, I getting field sourcetype with the value "coalesce(field1,field2)". How to solve an issue?

Thanks.

[General_Talos · Accepted solution]

Try in props.conf

[source::/path/to/folder/*]
EVAL-sourcetype = coalesce(field1,field2)

[rendie]

Oh yeah, it works for me. Thank you