Lets say I have extracted two fields rs_time1 and rs_time2. But now, I want to merge the values from these fields to one single field called rs_time . I have the following query, which does correctly what I wanted in search time , but is there a way to do it permanently rather than during search time ?
| eval "rs_time"=coalesce(rs_time1,rs_time2)
|stats avg(rs_time) as res_time
assuming Splunk is identifying the fields and that you have not manually extracted them:
in props.conf
[sourcetype]
EVAL-rs_time = if(isnotnull('rs_time1'),'rs_time1','rs_time2')
If the data comes from a heavy forwarder, you can use transforms.conf to create the merged field before the data is ingested to your indexers
Hey @navd,
sure it's possible and you already have the right strategy with the coalesce
command.
I posted you a link about Calculated Fields that will help you further.
http://docs.splunk.com/Documentation/Splunk/7.1.2/Knowledge/definecalcfields
Tell us if you need further assistance.
@navd,
did this help you?