I have a query that returns a table like below
Component Hits ResponseTime Req-count
Comp-1 100 2.3
Comp-2 5.6 240
Both Hits and Req-count means the same but the header values in CSV files are different. I want the result to look like
Component Hits ResponseTime
Comp-1 100 2.3
Comp-2 240 5.6
I should make both the fields as same. I tried rename and it did not work.
It would be very helpful if someone can share their suggestions.
Just tack on one extra line, like this:
Your Existing Search Here
| eval Hits = coalesce(Hits, 'Req-count') | fields - "Req-Count"
Just tack on one extra line, like this:
Your Existing Search Here
| eval Hits = coalesce(Hits, 'Req-count') | fields - "Req-Count"
Please post the exact search code with the rename that did not work Remember to mark it as code so that the interface will not alter the code.
I suspect that the problem is a capitalization or spelling error, either in the rename line or in a prior line.
have you tried coalesce? |eval newField=coalesce(Hits,'Req-count')|fields - Hits "Req-Count"