How to unite different fields into one field?

[marxsabandana]

I'm about to unite product codes from 2 different sourcetypes with different names, but with the same value.

Here's a sample table:
ProdID_1 (from sourcetype A)

0001596

ProdID_2 (from sourcetype B)
0001596

My desired output should be unified like this:
ProdID
0001596

[koshyk · Accepted solution]

There are quite few methods depending on how much other fields you want to protect/align
1. Using Rename

index=* (sourcetpe=A Or sourcetype=B) | rename ProdID_1 as ProdID| rename ProdID_2 as ProdID

1. using eval (if you need to keep the original fields too)

index=* (sourcetpe=A Or sourcetype=B) | eval ProdID=ProdID_1 | eval ProdID=ProdID_2

1. Using transaction (if you want to club events of same ProdID into single transaction)

   index=* (sourcetpe=A Or sourcetype=B) | rename ProdID_1 as ProdID| rename ProdID_2 as ProdID
| transaction ProdID