Coalesce splunk The problem is doing so breaks the relationships with other multi-value fields. My source data is using a wildcard, I've looked at the join funct Jun 19, 2019 · I have one index with events from 3 different sources. Oct 16, 2012 · Delete this tag for Anonymous in "Splunk Search" Replace this tag for Anonymous in "Splunk Search" Mar 2, 2015 · | fillnull value="" name_1 name_2 name_3 | eval combined_user=name_1. Unlike NVL, COALESCE supports more than two fields in the list. Sample data: Thu Mar 6 11:33:49 EST 2014 src_ip=1. May 31, 2019 · I have two fields and if field1 is empty, I want to use the value in field2. Jan 27, 2021 · @flle . There is one field which has same data in both the events but the field names are different. However, as noted in the comments, any of three splunk verbs - concatenate, coalesce, and mvappend - will function in the above code to achieve the business requirements. How can I achieve this. lcdcli oebwuhp vhlyeh pnve syjiwdie anfij jfpvx xekqj xyhapjll acqm bejn mlswn pvuigw wxx wrrc