From our data we end up with 2 different fields v7serial & v8serial. I want to be able to feed this into a single serial v78serial.
Example of data
v7serial
987654321
v8serial
123456789
v78serial
123456789
987654321
I am trying
| eval v78serial= toString(v8serial) + ";" + toString(v7serial)
| makemv delim=";" allserials
| mvexpand v78serial | table v78serial
The problem is when i display this data or try to use this field i get "123456789;null" this is because the data has either a v7 or v8 serial never both. So where one field is Null then don't add it to the new field.
Try like this
your base search | eval v78serial=coalesce(v8serial,v7serial,"") | table v78serial
Try like this
your base search | eval v78serial=coalesce(v8serial,v7serial,"") | table v78serial