Hello everyone,
I am having two events with different sourcetypes that have similar fields with similar values however not the same.
I have found a way to combine the fields by using coalesce, however I would like to combine the values as well in order to get a clear result
I am running this search :
index="main" category="Foo" OR sourcetype="foo"
| iplocation ip_address
| eval severity_level = coalesce(severity, foo_severity)
| geostats count by severity_level
and I am having the following results.
| longitude | latitude | HIGH | High | MEDIUM | Medium | LOW | Low |
| 143.2104 | -33.494 | 39 | 4 | 40 | 30 | 15 | 5 |
And I want to get something like:
| longitude | latitude | HIGH | MEDIUM | LOW |
| 143.2104 | -33.494 | 43 | 70 | 20 |
Could you please give a hint? Thank you very much in advance.
Hi @aristidiskantas,
you have to convert all values in upper or lower case, something like this:
index="main" category="Foo" OR sourcetype="foo"
| iplocation ip_address
| eval severity_level = upper(coalesce(severity, foo_severity))
| geostats count by severity_level
Ciao.
Giuseppe
Hi @aristidiskantas,
you have to convert all values in upper or lower case, something like this:
index="main" category="Foo" OR sourcetype="foo"
| iplocation ip_address
| eval severity_level = upper(coalesce(severity, foo_severity))
| geostats count by severity_level
Ciao.
Giuseppe
That worked! Thank you so mush for the input Giuseppe.
Wish you the best,
Aris
Hi @aristidiskantas,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated ;-