I have three fields name_1, name_2, and name_3 that I would like to combine into one field. There is no guarantee that all three fields will contain information. I was able to locate this eval string.
|eval combined_name=if (isnotnull(name_3),name_1.name_2.name_3,name_1.name_2)
Basically if name_3 is null, name_1 and name_2 combine. This is working great until name_1 or name_2 are null. I tried a number of attempts but I am not coming up with the solution.
Examples:
|eval combined_user=if (isnotnull(name_3),name_1.name_2.name_3,name_1.name_2, name_1)
|eval combined_user=if (isnotnull(name_3)OR(name_2),name_1.name_2.name_3,name_1.name_2, name_1, name_2.name_3)
I also tried the following, but then realized, it will only display the first non-null field.
|eval combined_user=coalesce(name_1.name_2.name_3)
Has anyone had success with the 3+ fields?
Thanks, Jennifer
... View more