Answer by warren for Splunk Coalesce Function

The SPL you shared shows the rename after you attempt to coalesce():

base search
| eval test=coalesce(field1,field2)
| rename "space field 1" AS field1, "space field 2" AS field2
| table field1 field2 test

Pretty sure what you want is this:

base search
| rename "space field 1" AS field1, "space field 2" AS field2
| eval test=coalesce(field1,field2)
| table field1 field2 test

from User warren – Stack Overflow https://stackoverflow.com/questions/76102751/splunk-coalesce-function/76103449#76103449
via IFTTT