Splunk Coalesce Command

EVAL-parent_process_guid = case(coalesce == null, null(),

coalesce Returns the first value that is not null coalesce, url_decode, url_decode('https%3a%2f

opposite of coalesce The Splunk platform removes the barriers between data and action, empowering observability, IT and security teams to ensure their organizations are secure,

coalesce bigquery is a collection of Splunk searches and other Splunk resources eval Source = coalesce table Source type time lastTime