search where a field is IN another search

[pinzer]

Hi all i need to do a search like this:

sourcetype="webseal_access" OR sourcetype="wmi:wineventlog:security" | rename Source_Network_Address as IP | rename IP_Source as IP

where the IP is in a field of another search. How can i do this?
Thanks

[vbumgarn]

If the IP could possibly be in several locations, and you want to normalize them into a field, I like the coalesce command in eval.

sourcetype="webseal_access" OR sourcetype="wmi:wineventlog:security" | eval IP = coalesce(Source_Network_Address,IP_Source)

This says "make a new field called IP, and use the value from the first non-empty field."

http://www.splunk.com/base/Documentation/latest/SearchReference/CommonEvalFunctions

[southeringtonp]

Take a look at the format command:
    http://www.splunk.com/base/Documentation/4.1.5/SearchReference/format