Stats count query across possible fields from multiple sources?

[spark2310]

I am trying to create an alert but some issues with logging that is not standard, so each sourcetype has it's own certain fieldname for error levels (e.g. type), and another certain fieldname for their error message (e.g. msg, or Massage)... in other words, I know the possible field values common across sourcetypes and eventually wanting to timechart or stat to cover all possible fields regardless of data source

This still does not work and if a certain field does not exist, all results will be null. any ideas or a different way to do it?

My query: index=t sourcetype=* (type=error OR T=error OR Level=Critical) (msg=* OR MSG=* OR Message=* OR message=* OR reason=*) |eval MM=msg."".MSGmsg."".Message."".message."".reason|timechart count by MM

[richgalloway · Accepted solution]

Concatenation will not solve that problem. You want the coalesce function. It chooses the first non-null field from its arguments as its result, which is exactly what you need when some fields are present in some events, but not others.

index=t sourcetype= (type=error OR T=error OR Level=Critical) (msg= OR MSG= OR Message= OR message= OR reason=) 
|eval MM=coalesce(msg,  MSGmsg, Message, message, reason) 
|timechart count by MM