Splunk Search

Can I rename different fields the same thing?

Federica_92
Communicator

I'm working with a dataset that lists companies and individual people, so that some entries have the field "Entity Name" and some have "Individual Name". I'd like to output a table with both of these fields shown under a single "Name" field. When I try to rename them both by this title, though, the second command overwrites the first one. Is there a way to have both fields listed under the same title, while keeping them as separate events?

Tags (3)
1 Solution

Runals
Motivator

I often use coalesce in these cases; hopefully it will work in yours.

... | eval name = coalesce(entityName, individualName) | ... 

This assumes every event will have either one or the other field. Otherwise I think if it has both it will grab the fields in the order listed. I often use that for especially Windows logs where the field used might be different for the same type of event based on OS version or specific event ID.

View solution in original post

stephane_cyrill
Builder

Hi Federica_92,

I the following can solve your problem:

.........|eval SingleName=mvzip(entityName, individualName)| makemv delim="," SingleName|mvexpand SingleName

For Example if you want to have both host and soure in the same field call SingleName :

index=*|table host source|eval SingleName=mvzip(host,source)| makemv delim="," SingleName|mvexpand SingleName

I hope you will be satisfied.

fdi01
Motivator

u can try like this:
... |rename entityName as Name |eval Name ="companie name:" + Name + "and people name:" + individualName | ...

NOUMSSI
Builder

Hi,
Try this

...|rename "Entity Name"  as EntityName| rename "Individual Name"  as IndividualName |eval name=EntityName  +  IndividualName |...

Runals
Motivator

I often use coalesce in these cases; hopefully it will work in yours.

... | eval name = coalesce(entityName, individualName) | ... 

This assumes every event will have either one or the other field. Otherwise I think if it has both it will grab the fields in the order listed. I often use that for especially Windows logs where the field used might be different for the same type of event based on OS version or specific event ID.

Runals
Motivator

Another way to do it might be something like

... | eval name = if(isnotnull(entityName), entityName, individualName) | ...
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...