Splunk Tutorials: Splunk Commands Reference -

Splunk Coalesce Command splunk coalesce splunk logo Splunk datadog logo Datadog new relic logo New Relic snowflake coalesce · concat · constants · env · format · join · json_decode · json_path splunk coalesce Double quotes make splunk think the value is a literal string, rather than a field Use single quotes in your coalesce instead, and you should

opposite of coalesce  eval src_ip = coalesce eval hostname = coalesce