topic Re: How to create an eval for a field if it does not exist? in Getting Data In

How to create an eval for a field if it does not exist?

mjuestel2 — Fri, 14 Apr 2023 16:23:10 GMT

I am in the process of normalizing data, so I can apply it to a data model. One of the fields which is having issues is called user.

I have user data in some logs, while other logs have an empty user field - but do have data in a src_user field.

Tried using the coalesce command - but that does not seem to work.

EVAL-user = coalesce(user, src_user)

Is it because I am trying to reference the user field?

Are there any other work arounds to create a user field when it is empty and filling data from src_user ? Remember, some logs have valid data in the user field. Others have no data.

Thanks!

Re: Creating an EVAL for a field if it does not exist

gcusello — Fri, 14 Apr 2023 07:07:59 GMT

Hi @mjuestel2,

to normalize the src_user field from the user field you can use an alias field (this is the usual approach to missing fields or fields with a wrong name).

If instead there are some events that have the src_user and some others that don't have it, you can use the coalesce option in eval.

If it doesan't run, you can use a calculated field like the following:

| eval src_user=if(isnull(src_user),user,src_user)

Ciao.

Giuseppe

Re: How to create an eval for a field if it does not exist?

woodcock — Fri, 14 Apr 2023 18:04:55 GMT

It is likely that it is already done correctly for you if this is typical Enterprise software generating the data and you have the matching TAs installed everywhere. In other words, "src_user" and "user" are typically different because it is "src_user" (e.g. "admin") doing something TO some other "user". In any case, the reason that your calculated search is not working is because of this:
https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Searchtimeoperationssequence