Splunk Search

How to combine the output of 2 different fields into one single field?

snix
Communicator

I have two fields I would like to combine into one field.

  field1      |    field2    |      combined field
1.    Bob                                      Bob
2.                   Jeff                     Jeff
3.                   Jack                     Jack
4.    Frank                                   Frank

Only one field is ever populated at any one time so it is a bit redundant to have two fields that hold very similar information. These should just be combined into a single field.

0 Karma
1 Solution

snix
Communicator

Okay just found the answer on this post:
https://answers.splunk.com/answers/432887/how-to-combine-common-fields-from-search-results-i.html?ut...

This is the line I needed to get the output I am looking for:
eval "New Field Name"=coalesce(field1,field2)

View solution in original post

justinw
Explorer

If you always want the two fields to be combined, and they won't both be populated at once, you could make a field alias to rename field1 as field2 or vice versa. May be a slightly more useful/easy solution if it applies.

0 Karma

snix
Communicator

Okay just found the answer on this post:
https://answers.splunk.com/answers/432887/how-to-combine-common-fields-from-search-results-i.html?ut...

This is the line I needed to get the output I am looking for:
eval "New Field Name"=coalesce(field1,field2)

aaraneta_splunk
Splunk Employee
Splunk Employee

@snix - Glad you found the answer to your question. Please don't forget to "Accept" your answer to resolve this post so that others can easily find it, in case they run into the same type of problem. Thanks.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...