Hi,
I have the below stats result
**Service Method Action**
Service1 Method1 NULL
Service2 Method2 NULL
Service3 NULL Method3
Service4 NULL Method4
Now I want to merge Method and Action Fields into a single field by removing NULL values in both fields.
Hey,
This looks like the perfect use case for coalesce()
:
| eval Method=coalesce(Method, Action)
Read up on its details here:
http://docs.splunk.com/Documentation/Splunk/7.1.0/SearchReference/ConditionalFunctions
Hey,
This looks like the perfect use case for coalesce()
:
| eval Method=coalesce(Method, Action)
Read up on its details here:
http://docs.splunk.com/Documentation/Splunk/7.1.0/SearchReference/ConditionalFunctions