i have two columns A and B.
i have values in A column for all rows and B column has some values in rows.
i want to join where B column should replace the values in A columns and if B is empty value it should retain column A value
pls see below columns reference. i want output like c column
A B C
aa bbc bbc
123 321 321
1234 1234
325 325
Try coalesce
,your search>|eval C=coalesce(B,A)
Hi premranjithj,
Can you try below eval if it helps you
index=xyz| eval c=case(if(B="*", "B", B="", "A"))
Try this!
| eval c=if(B!="*",B,A)
Let me know if it helps!