I'm trying to normalize various user fields within Windows logs. The fields I'm trying to combine are users Users and Account_Name.
My query isn't failing but I don't think I'm quite doing this correctly.
I'm using the string:
| eval allusers=coalesce(users,Users,Account_Name)
coalesce
takes a number of fields and returns the first one that is not null. So, if that's the behaviour you want, your query seems fine to me.
I want to not have duplicates that may exist in both fields.
Jsmith may have logged onto a Win Server 2k3 box and the field is called "users" then he may log onto a win 2k8 box and the field is called "Users" The differences being the uppercase and lowercase "u"
Do you want to concatenate those fields or use the first in that list that is not null?