How to merge two fields into one field?

[lpolo]

I have the following result set coming from a search:

field_1 field_2
 1       2
 3       4
 5       6

I need to merge these two fields into a new field "output":

output
 1
 2
 3
 4
 5
 6

Thanks,
Lp

[lguinn2]

If field1 is multivalued, you can do this:

 eval output = mvappend(field1,field2)

To remove nulls:

eval output = mvfilter(output!=null())

[ryhluc01]

@lguinn2 Make this a comment so that it can be accepted as an answer. I found this to be correct.

[lpolo]

Nice learning experience. Thanks.

[ibekacyril]

Sorry for the late show, but this returns null in the second field

[seanclark]

I am getting the null response as well.

[somesoni2]

Is one of your fields that you're merging contains null values?

[seanclark]

Apparently they did, but I could not find where they were. I also had to manipulate this solution some to get what I wanted. I had to fields that had IPs in them so I did this.

myprecious | fillnull value="" source_address ip_address| eval output =ip_address.source_address

[lguinn2]

Here is one way- but there is probably something better

yoursearchhere |
rename field1 as output |
append [search yoursearchhere earliest=-24h |
rename field2 as output ]

This runs the search twice...

Notice that I included earliest=-24h for the inner search. Otherwise, this will search over all time - it is not affected by the time selector. [No longer true - the inner search runs over the range specified by the timerange selector.]

[landen99]

The subsearch naturally carries the time of the outer search unless otherwise specified, as I understand it.

[lguinn2]

Agreed @landen99, but that was not true in 2012 🙂

[Ayn]

Well give more details. You didn't state that this was going to be used across millions events. Also you need to give more details on the search you're using to generate these fields. Do field1 and field2 belong to the same search result? Do both fields always occur in all events you want to apply this to?

[lpolo]

This approach is expensive and might not work when dealing with millions of events.
Thanks.