The Splunk
coalesce function returns the first non-null value among its arguments. It’s useful for normalizing data from different sources with varying field names.For example, to unify multiple source IP fields into a single
src_ip field:| eval src_ip = coalesce(src_ip, sourceip, source_ip, sip, ip)The post coalesce Function in Splunk appeared first on SOC Prime.