Splunk Search

How to unite different fields into one field?

Explorer

I'm about to unite product codes from 2 different sourcetypes with different names, but with the same value.

Here's a sample table:
ProdID_1 (from sourcetype A)

0001596

ProdID_2 (from sourcetype B)
0001596

My desired output should be unified like this:
ProdID
0001596

1 Solution

Super Champion

There are quite few methods depending on how much other fields you want to protect/align
1. Using Rename

index=* (sourcetpe=A Or sourcetype=B) | rename ProdID_1 as ProdID| rename ProdID_2 as ProdID
  1. using eval (if you need to keep the original fields too)

index=* (sourcetpe=A Or sourcetype=B) | eval ProdID=ProdID_1 | eval ProdID=ProdID_2

  1. Using transaction (if you want to club events of same ProdID into single transaction)

    index=* (sourcetpe=A Or sourcetype=B) | rename ProdID_1 as ProdID| rename ProdID_2 as ProdID
    | transaction ProdID

View solution in original post

Super Champion

There are quite few methods depending on how much other fields you want to protect/align
1. Using Rename

index=* (sourcetpe=A Or sourcetype=B) | rename ProdID_1 as ProdID| rename ProdID_2 as ProdID
  1. using eval (if you need to keep the original fields too)

index=* (sourcetpe=A Or sourcetype=B) | eval ProdID=ProdID_1 | eval ProdID=ProdID_2

  1. Using transaction (if you want to club events of same ProdID into single transaction)

    index=* (sourcetpe=A Or sourcetype=B) | rename ProdID_1 as ProdID| rename ProdID_2 as ProdID
    | transaction ProdID

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!