Splunk Search

Merge 2 columns into one

premraj_vs
Path Finder

I have a query that returns a table like below

Component Hits ResponseTime Req-count
Comp-1 100 2.3
Comp-2 5.6 240

Both Hits and Req-count means the same but the header values in CSV files are different. I want the result to look like

Component Hits ResponseTime
Comp-1 100 2.3
Comp-2 240 5.6

I should make both the fields as same. I tried rename and it did not work.

It would be very helpful if someone can share their suggestions.

0 Karma
1 Solution

woodcock
Esteemed Legend

Just tack on one extra line, like this:

Your Existing Search Here
| eval Hits = coalesce(Hits, 'Req-count') | fields - "Req-Count"

View solution in original post

woodcock
Esteemed Legend

Just tack on one extra line, like this:

Your Existing Search Here
| eval Hits = coalesce(Hits, 'Req-count') | fields - "Req-Count"

DalJeanis
Legend

Please post the exact search code with the rename that did not work Remember to mark it as code so that the interface will not alter the code.

I suspect that the problem is a capitalization or spelling error, either in the rename line or in a prior line.

0 Karma

cmerriman
Super Champion

have you tried coalesce? |eval newField=coalesce(Hits,'Req-count')|fields - Hits "Req-Count"

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

How to find the worst searches in your Splunk environment and how to fix them

Everyone knows Splunk is a powerful platform for running searches and doing data analytics. Your ...

Share Your Feedback: On Admin Config Service (ACS)!

Help Us Build a Better Admin Config Service Experience (ACS)   We Want Your Feedback on Admin Config Service ...