Splunk Search

Merge two disjunct number fields into one

mhornste
Path Finder

Hi,

I had to switch from one DB Connect App to another which leads to two fields where I have my version information:

AverageVersions2
AverageVersions

both fields are disjunct regarding the data in it meaning that intil 10th of August, AverageVersions has data, after that AverageVersions2 has data.

I now want to display the data in my graph showing all values. I tried the following without success:
index=otcs sourcetype=OtcsAvgVersions | rename AverageVersions2 as output | rename AverageVersions as output | table _time output| reverse

The problem is: the data from AverageVersions from 11th of August is not displayed.

Can anyone help please?

Tags (2)
0 Karma
1 Solution

davebrooking
Contributor

The eval coalesce function may be of use here, as the documentation states the function takes an arbitrary number of arguments and returns the first value that is not null. Maybe something like:

index=otcs sourcetype=OtcsAvgVersions | eval output=coalesce(AverageVersions2,AverageVersions) | table _time output | reverse

Dave

View solution in original post

davebrooking
Contributor

The eval coalesce function may be of use here, as the documentation states the function takes an arbitrary number of arguments and returns the first value that is not null. Maybe something like:

index=otcs sourcetype=OtcsAvgVersions | eval output=coalesce(AverageVersions2,AverageVersions) | table _time output | reverse

Dave

mhornste
Path Finder

Thats it, thanks!

0 Karma

woodcock
Esteemed Legend

Be sure to click "Accept" on this Answer to close the Question.

0 Karma
Get Updates on the Splunk Community!

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...