Splunk Search

Pls help me with JOIN to have columns

Builder

i have two columns A and B.
i have values in A column for all rows and B column has some values in rows.
i want to join where B column should replace the values in A columns and if B is empty value it should retain column A value
pls see below columns reference. i want output like c column
A B C
aa bbc bbc
123 321 321
1234 1234
325 325

0 Karma

Ultra Champion

Try coalesce

,your search>|eval C=coalesce(B,A)

0 Karma

Contributor

Hi premranjithj,
Can you try below eval if it helps you
index=xyz| eval c=case(if(B="*", "B", B="", "A"))

0 Karma

SplunkTrust
SplunkTrust

Try this!

| eval c=if(B!="*",B,A)

Let me know if it helps!