coalesce Function in Splunk

The Splunk coalesce function returns the first non-null value among its arguments. It’s useful for normalizing data from different sources with varying field names.

For example, to unify multiple source IP fields into a single src_ip field:

| eval src_ip = coalesce(src_ip, sourceip, source_ip, sip, ip)