Splunk Tutorials: Splunk Commands Reference -

Splunk Tutorials: Splunk Commands Reference - splunk coalesce coalesce eval remote_host=replace(remote_host, d+$,) coalesce synonyms Using the splunk coalesce command can create a new field with information from both fields and can also insert a value if none exists

coalesce synonyms Splunk query will return all the events within a five minute time coalesce fields from different sources or indexes to create a transaction of

coalesce bigquery EVAL-parent_process_guid = case(coalesce == null, null(), Double quotes make splunk think the value is a literal string, rather than a field Use single quotes in your coalesce instead, and you should