Splunk Search

Merge 2 columns into one

premraj_vs
Path Finder

I have a query that returns a table like below

Component Hits ResponseTime Req-count
Comp-1 100 2.3
Comp-2 5.6 240

Both Hits and Req-count means the same but the header values in CSV files are different. I want the result to look like

Component Hits ResponseTime
Comp-1 100 2.3
Comp-2 240 5.6

I should make both the fields as same. I tried rename and it did not work.

It would be very helpful if someone can share their suggestions.

0 Karma
1 Solution

woodcock
Esteemed Legend

Just tack on one extra line, like this:

Your Existing Search Here
| eval Hits = coalesce(Hits, 'Req-count') | fields - "Req-Count"

View solution in original post

woodcock
Esteemed Legend

Just tack on one extra line, like this:

Your Existing Search Here
| eval Hits = coalesce(Hits, 'Req-count') | fields - "Req-Count"

DalJeanis
Legend

Please post the exact search code with the rename that did not work Remember to mark it as code so that the interface will not alter the code.

I suspect that the problem is a capitalization or spelling error, either in the rename line or in a prior line.

0 Karma

cmerriman
Super Champion

have you tried coalesce? |eval newField=coalesce(Hits,'Req-count')|fields - Hits "Req-Count"

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...