Splunk Search

Add values to the end of table

Abarny
Path Finder

Hi guys,

Can you tell me if is it possible to add a values on fields to the end of a table to an other fields

Exemple:
For moment I have that

TitreInit            TitileNew
Title 1            Title 7
                      Title 6
                      Title 5
                      Title 4
                      Title 3
                      Title 2

And i want this :

Title 

Title 7
Title 6
Title 5
Title 4
Title 3
Title 2
Title 1

I do this request :

index="gta_projets"
|fields logs{}.projectId, logs{}.newTitle  
|rename logs{}.projectId as "NOVA ID"
|join [|search index="gtav2_projects"  projects{}.icma="xxx" 
|fields projects{}.title, projects{}.id 
| rename projects{}.id  as "NOVA ID" ]
| stats values(projects{}.title) as TitreInit, list(logs{}.newTitle) as TitileNew
0 Karma
1 Solution

3no
Communicator

You're looking for coalesce command.

Add this at the end of your request :

|eval Title = coalesce(TitreInit,TitileNew) | table Title

View solution in original post

3no
Communicator

You're looking for coalesce command.

Add this at the end of your request :

|eval Title = coalesce(TitreInit,TitileNew) | table Title

Abarny
Path Finder

Thanks you !

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...