How can I consolidate 2 or more fields into one new field at search time?
e.g. ...| fields a,b,c | d
In the above I would like d to hold all values in fields a,b,c so what I am doing is creating a new field called d out of the fields a,b and c. Is this possible?
asked 28 Apr '10, 16:58
If you want them all concatenated, then you can do:
If you want a multi-value field, you could do something like this (assuming that you don't have
If you are trying to get a single value when a, b, or c could be null (or missing), then you can use:
Are any of these what you are looking for?
answered 28 Apr '10, 17:14
Also, if you want to create a single multi-valued field, you would concatenate the values with a delimiter as in one of the other answers, and then use the
answered 28 Apr '10, 17:50
Eval command could do this:
Also, the nomv command might be helpful for your use case: