eval & coalesce

[hagjos43]

I'm trying to normalize various user fields within Windows logs. The fields I'm trying to combine are users Users and Account_Name.

My query isn't failing but I don't think I'm quite doing this correctly.

I'm using the string:
| eval allusers=coalesce(users,Users,Account_Name)

[Ayn]

coalesce takes a number of fields and returns the first one that is not null. So, if that's the behaviour you want, your query seems fine to me.

[hagjos43]

I want to not have duplicates that may exist in both fields.
Jsmith may have logged onto a Win Server 2k3 box and the field is called "users" then he may log onto a win 2k8 box and the field is called "Users" The differences being the uppercase and lowercase "u"

[Ayn]

Do you want to concatenate those fields or use the first in that list that is not null?