Splunk Search

How to merge two field as sourcetype?

rendie
Path Finder

Hi,

I wanna merge two fields into sourcetype as below:

props.conf

[source::/path/to/folder/*]
sourcetype = coalesce(field1,field2)

 

So, as result, I getting field sourcetype with the value "coalesce(field1,field2)". How to solve an issue?

Thanks.

Labels (2)
0 Karma
1 Solution

General_Talos
Path Finder

Try in props.conf

[source::/path/to/folder/*]
EVAL-sourcetype = coalesce(field1,field2)

View solution in original post

0 Karma

General_Talos
Path Finder

Try in props.conf

[source::/path/to/folder/*]
EVAL-sourcetype = coalesce(field1,field2)
0 Karma

rendie
Path Finder

Oh yeah, it works for me. Thank you

0 Karma
Get Updates on the Splunk Community!

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...