Splunk Search
Highlighted

How to unite different fields into one field?

Explorer

I'm about to unite product codes from 2 different sourcetypes with different names, but with the same value.

Here's a sample table:
ProdID_1 (from sourcetype A)

0001596

ProdID_2 (from sourcetype B)
0001596

My desired output should be unified like this:
ProdID
0001596

0 Karma
Highlighted

Re: How to unite different fields into one field?

Super Champion

There are quite few methods depending on how much other fields you want to protect/align
1. Using Rename

index=* (sourcetpe=A Or sourcetype=B) | rename ProdID_1 as ProdID| rename ProdID_2 as ProdID
  1. using eval (if you need to keep the original fields too)

index=* (sourcetpe=A Or sourcetype=B) | eval ProdID=ProdID_1 | eval ProdID=ProdID_2

  1. Using transaction (if you want to club events of same ProdID into single transaction)

    index=* (sourcetpe=A Or sourcetype=B) | rename ProdID_1 as ProdID| rename ProdID_2 as ProdID
    | transaction ProdID

View solution in original post