Splunk Search

How to merge two field as sourcetype?

rendie
Path Finder

Hi,

I wanna merge two fields into sourcetype as below:

props.conf

[source::/path/to/folder/*]
sourcetype = coalesce(field1,field2)

 

So, as result, I getting field sourcetype with the value "coalesce(field1,field2)". How to solve an issue?

Thanks.

Labels (3)
0 Karma
1 Solution

General_Talos
Path Finder

Try in props.conf

[source::/path/to/folder/*]
EVAL-sourcetype = coalesce(field1,field2)

View solution in original post

0 Karma

General_Talos
Path Finder

Try in props.conf

[source::/path/to/folder/*]
EVAL-sourcetype = coalesce(field1,field2)

View solution in original post

0 Karma

rendie
Path Finder

Oh yeah, it works for me. Thank you

0 Karma