How do I join two fields together so there is not whitespace in my table. I want to join sfailed and EventCodeDescription so that it will list "Shutdown or reboot"
index="Desktop" (EventCode=513 OR EventCode=3003) OR reboot EventCodeDescription= "sfailed" OR "Shutdown"| rex"Shutdown\s\S+(?
Coalesce is probably not what you want; it picks the first non-null from the list and returns that. Instead, string manipulation will do what you want:
eval newField=EventCodeDescription + sfailed