https://community.splunk.com/t5/Splunk-Enterprise/is-it-possible-to-execute-code-based-on-a-condition/m-p/578437#M10964 <P>Yes I tried with fillnull but despite the zero values, the field names are wrong.<BR />Maybe I solved it by editing the | command stats sum<BR />Thank you</P> Wed, 15 Dec 2021 09:36:30 GMT antonio147 2021-12-15T09:36:30Z https://community.splunk.com/t5/Splunk-Enterprise/is-it-possible-to-execute-code-based-on-a-condition/m-p/578339#M10955 <P>Hi all,<BR />I wanted to ask a question: "is it possible to execute code based on a condition"?<BR />example: if A = B then "rename C as D" else "add a column"</P><P>My problem:<BR />the where returns columns usually 2, (DIRECT, INDIRECT) but there are some cases that returns 3 (DIRECT, INDIRECT, SPC)<BR />a case that returns only 1 (INDIRECT)<BR />another that returns 1 (DIRECT).<BR />When I do the chart, the third field is called "row 3" (I hope to solve with rename).<BR />When I have only one field (INDIRECT) it is called "row 1" but if I call it "DIRECT" it is not good as the values ​​are from the INDIRECT.<BR />Same thing for the field only (LIVE).<BR />The problem I would like is that the chart always has 2 bars for both DIRECT and INDIRECT, even when there is not one of the two.</P><P>with this code I have:<BR />| stats sum (*) by OFFERTA<BR />| transpose<BR />| addtotals fieldname = "TOTAL"<BR />| rename "row 1" as "DIRECT"<BR />| rename "row 2" as "INDIRECT"<BR />| rename "row 3" as "SPC"</P><P>Solar year&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; DIRECT&nbsp; &nbsp; &nbsp;INDIRECT&nbsp; &nbsp; &nbsp;TOTAL<BR />sum (00_PREVIOUS_MONTH)&nbsp; &nbsp; &nbsp; &nbsp; 8&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 4&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;12<BR />sum (01_PREVIOUS_MONTH)&nbsp; &nbsp; &nbsp; 32&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 16&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;48<BR />sum (02_PREVIOUS_MONTH)&nbsp; &nbsp; &nbsp; 42&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;10&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;52<BR />sum (03_PREVIOUS_MONTH)&nbsp; &nbsp; &nbsp; 30&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 8&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 38</P><P>but if I only have 1 field (INDIRECT)<BR />I have as a result:</P><P>Solar Year&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; DIRECT&nbsp; &nbsp; &nbsp; &nbsp;TOTAL<BR />sum (00_PREVIOUS_MONTH)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0<BR />sum (01_PREVIOUS_MONTH)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 3<BR />sum (02_PREVIOUS_MONTH)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1<BR />sum (03_PREVIOUS_MONTH)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;3<BR />sum (04_PREVIOUS_MONTH)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 2</P><P>&nbsp;</P><P>I would like the chart to have also in this case the two fields with DIRECT and INDIRECT with the DIRECT field all zero</P> Tue, 14 Dec 2021 15:17:32 GMT https://community.splunk.com/t5/Splunk-Enterprise/is-it-possible-to-execute-code-based-on-a-condition/m-p/578339#M10955 antonio147 2021-12-14T15:17:32Z https://community.splunk.com/t5/Splunk-Enterprise/is-it-possible-to-execute-code-based-on-a-condition/m-p/578432#M10963 Hi<BR />Have you try to use fillnull before stats for those null values? As you sum those then it shouldn't be a issue if those missing fields have value 0.<BR />r. Ismo<BR /><A href="https://docs.splunk.com/Documentation/Splunk/8.2.3/SearchReference/Fillnull" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.2.3/SearchReference/Fillnull</A> Wed, 15 Dec 2021 08:59:53 GMT https://community.splunk.com/t5/Splunk-Enterprise/is-it-possible-to-execute-code-based-on-a-condition/m-p/578432#M10963 isoutamo 2021-12-15T08:59:53Z https://community.splunk.com/t5/Splunk-Enterprise/is-it-possible-to-execute-code-based-on-a-condition/m-p/578437#M10964 <P>Yes I tried with fillnull but despite the zero values, the field names are wrong.<BR />Maybe I solved it by editing the | command stats sum<BR />Thank you</P> Wed, 15 Dec 2021 09:36:30 GMT https://community.splunk.com/t5/Splunk-Enterprise/is-it-possible-to-execute-code-based-on-a-condition/m-p/578437#M10964 antonio147 2021-12-15T09:36:30Z