Splunk Search

How to create unique field names from two data sources that share a common field name?

pkeller
Contributor

I have two data sources, each with a field named foo.
Each data source has a different sourcetype, so I'd like to do something like this:

(sourcetype=STa) OR (sourcetype=STb) | ...

if sourcetype is STa, I'd like to rename foo to fooA
if sourcetype is STb, I'd like to rename foo to fooB

Using eval fooA = coalesce(foo,NULL) works, but I'm not sure how to make it conditional so that it only acts on events with the STa sourcetype.

Thank you

0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

You can use the following technique:

eval fooA = if(sourcetype == "STa", foo, "")

And the same for fooB

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

IMO, the coalesce approach is what's needed here. It'll run for each event (for both sourcetypes) but so as any rename command.

0 Karma

pkeller
Contributor

I'd considered that, but wasn't quite sure how to place the coalesce into an "if" block

0 Karma

javiergn
SplunkTrust
SplunkTrust

You can use the following technique:

eval fooA = if(sourcetype == "STa", foo, "")

And the same for fooB

0 Karma

pkeller
Contributor

Thank you very much.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...