Getting Data In

How to handle a field alias for two fields in search results when the source type is the same?

arrowecssupport
Communicator

We have data which can display a computer's serial number. The data is a little odd and we have to extract the serial number using 1 rex and 1 is done automatically. This creates 2 fields serialnumber1 & serialnumber2 .

I've tried to create an alias called serialnumber, but I've run into problems.

Applies to sourcetype = imap
Field aliases >  serialnumber1 =serialnumber
Field aliases >  serialnumber2 =serialnumber

The problem is that when both fields are populated, serialnumber is populated

1. When serialnumber1 is NULL and serialnumber2 is populated, "serialnumber" is populated
2. When serialnumber1 is populated and serialnumber2 is NULL,"serialnumber" IS NOT POPULATED
3. When Both serialnumber1 & serialnumber2 are populated, "serialnumber" is populated

Why is this case that when search result 2. above is true the aliases fail.

0 Karma

woodcock
Esteemed Legend

If it is an eventtype then you can obscure the fact that there are 2 fields by making it use the search serialnumber1="MyValue" OR serialnumber2="MyValue". Then you can access it through a macro that adds the coalesce command so your search would be:

`MyMacro` | rest of your search
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi arrowecssupport,
if you can fix a priority in fields use, you could you coalesce function:
| eval serialnumber=coalesce(serialnumber1,serialnumber2)

Bye.
Giuseppe

0 Karma

arrowecssupport
Communicator

Thanks that appears to work and might work in some situations.
Problem is want to be able to create a search into an Event type and this isn't possible when you use a pipe.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...