Splunk Search

Merge 2 columns into one

premraj_vs
Path Finder

I have a query that returns a table like below

Component Hits ResponseTime Req-count
Comp-1 100 2.3
Comp-2 5.6 240

Both Hits and Req-count means the same but the header values in CSV files are different. I want the result to look like

Component Hits ResponseTime
Comp-1 100 2.3
Comp-2 240 5.6

I should make both the fields as same. I tried rename and it did not work.

It would be very helpful if someone can share their suggestions.

0 Karma
1 Solution

woodcock
Esteemed Legend

Just tack on one extra line, like this:

Your Existing Search Here
| eval Hits = coalesce(Hits, 'Req-count') | fields - "Req-Count"

View solution in original post

woodcock
Esteemed Legend

Just tack on one extra line, like this:

Your Existing Search Here
| eval Hits = coalesce(Hits, 'Req-count') | fields - "Req-Count"

DalJeanis
Legend

Please post the exact search code with the rename that did not work Remember to mark it as code so that the interface will not alter the code.

I suspect that the problem is a capitalization or spelling error, either in the rename line or in a prior line.

0 Karma

cmerriman
Super Champion

have you tried coalesce? |eval newField=coalesce(Hits,'Req-count')|fields - Hits "Req-Count"

Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...