coalesce()
Table of Contents
Examples
The following example returns either customer ID or transaction ID with coalesce(), depending on if there’s a NULL value in 'customerId' column. rex4j is used to extract ID values into separate columns and table to show only '_time', 'customerId', 'transactionId', and 'ID' columns.
index=sales_inventory earliest=-5y
| rex4j field=_raw "customerId=\"(?<customerId>[a-zA-Z0-9]+-[a-zA-Z0-9]+-[a-zA-Z0-9]+-[a-zA-Z0-9]+-[a-zA-Z0-9]+)"
| rex4j field=_raw "transactionId=(?<transactionId>[a-zA-Z0-9]+-[a-zA-Z0-9]+-[a-zA-Z0-9]+-[a-zA-Z0-9]+[a-zA-Z0-9]+)"
| eval ID=coalesce(customerId, transactionId)
| table _time, customerId, transactionId, ID