Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Merge two disjunct number fields into one
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I had to switch from one DB Connect App to another which leads to two fields where I have my version information:
AverageVersions2
AverageVersions
both fields are disjunct regarding the data in it meaning that intil 10th of August, AverageVersions has data, after that AverageVersions2 has data.
I now want to display the data in my graph showing all values. I tried the following without success:
index=otcs sourcetype=OtcsAvgVersions | rename AverageVersions2 as output | rename AverageVersions as output | table _time output| reverse
The problem is: the data from AverageVersions from 11th of August is not displayed.
Can anyone help please?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The eval coalesce function may be of use here, as the documentation states the function takes an arbitrary number of arguments and returns the first value that is not null. Maybe something like:
index=otcs sourcetype=OtcsAvgVersions | eval output=coalesce(AverageVersions2,AverageVersions) | table _time output | reverse
Dave
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The eval coalesce function may be of use here, as the documentation states the function takes an arbitrary number of arguments and returns the first value that is not null. Maybe something like:
index=otcs sourcetype=OtcsAvgVersions | eval output=coalesce(AverageVersions2,AverageVersions) | table _time output | reverse
Dave
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thats it, thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Be sure to click "Accept" on this Answer to close the Question.
Index This | When is October more than just the tenth month?
Observe and Secure All Apps with Splunk
What’s New & Next in Splunk SOAR
