Splunk Search

Merge event field into single table column

skottieb
Explorer

Hi,
I'm trying to take filds from different events and put them in one table column. I've true this using the rename command, however, only the first rename files as SocialMediaPost it matched.

index="mail" (text!='' OR status!='' OR comment_text!='' OR message!='') | rename text as SocialPostData status as SocialPostData comment_text as SocialPostData message as SocialPostData | table URL User SocialPostData

Any help, much appreciated!

Scott-

Tags (3)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Hmm... you might be looking for this:

... | eval data = coalesce(text, status, comment_text, message) | fields - text status comment_text message

That will take the first value that isn't null and write it into the data field.

skottieb
Explorer

That is perfect. Thank you!

0 Karma

skottieb
Explorer

Now - 4 column of data.


text status comment_text message

It's+all+good.

This.%20Is.%20Awesome%21%21

please%20do%20tell%2C%20soon!

more%20random

tweeted

tweeteed

Test%20mobile%0A

this%20is%20comment%20data

tweeter

missing

Want this consolidated to 1.

data

It's+all+good.
This.%20Is.%20Awesome%21%21
please%20do%20tell%2C%20soon!
more%20random
tweeted
tweeteed
Test%20mobile%0A
this%20is%20comment%20data
tweeter

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

What output are you getting now, and what does your desired output look like?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...