USAGE OF SPLUNK EVAL FUNCTION : COALESCE

coalesce Returns the first value that is not null coalesce, url_decode, url_decode('https%3a%2f

Double quotes make splunk think the value is a literal string, rather than a field Use single quotes in your coalesce instead, and you should

coalesce synonyms is a collection of Splunk searches and other Splunk resources eval Source = coalesce table Source type time lastTime

splunk coalesce coalesce 20:50 - tstats Eval Command In Splunk