Struggling with a multi-log transaction

[mgagliardi]

I'm trying to establish a transaction. The information is in two different indexes, different sourcetypes, etc. Basically what I've got in index 1 is a bunch of XML-formatted Windows event log data...I'm able to successfully do the necessary search, run an spath on it to extract the field/value I need (a domain\username), etc. The other index contains pretty basic log data, including a field named "SlotID" that contains data formatted as domain\username. I'm also able to run a search successfully to grab that data. This is what the beginning of my search looks like:

host= (index=main sourcetype= Message=) OR (index=wineventlog EventID=800) | spath output=user path=Event.UserData.EventXML.param1 | eval lcuser=lower(user)

At that point if I go look at my search results I have all the data I need to get the transaction duration (which starts with the EventID=800 and ends with the log message). My problem is the common value resides in two differently-named fields (lcuser and SlotID). I have tried rename...but end up with only one event type "winning" (whichever one I rename last) and containing the new/renamed field). Same deal with eval to a new field...the last eval wins and the first eval no longer contains that field.

I'm lost and really hoping someone can lend a hand...been beating my head against the wall on this for the better part of 4 hours.

TIA!

[mgagliardi · Accepted solution]

coltwanger's response was the (or at least a) correct answer, it worked for my use case.

[coltwanger]

Have you tried coalesce?

| eval combined=coalesce(lcuser, SlotID)

[mgagliardi]

Dude, you're a damn witch! That's got it 🙂 Thanks so much, you just ended my week on a positive note.

[coltwanger]

Awesome! Have a great weekend 🙂