https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-the-following-query-using-the-coalesce/m-p/411817#M118766 <P>You can use this:</P> <PRE><CODE>EVAL-subjectuser=if(subjectuser=="-", targetuser, subjectuser) </CODE></PRE> <P>Or in search SPL, this:</P> <PRE><CODE>| eval subjectuser=if(subjectuser=="-", targetuser, subjectuser) </CODE></PRE> Mon, 26 Nov 2018 21:41:59 GMT woodcock 2018-11-26T21:41:59Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-the-following-query-using-the-coalesce/m-p/411815#M118764 <P>I am trying this transform. Sometime the subjectuser is set and sometimes the targetuser. All works fine, but the data coming into the subject user is a dash, and that is what user is getting set to instead of the value that is correct in target user.</P> <P>Is there any way around this? So, if a subject user is less than 2 characters for example?</P> <P>Thanks!</P> Mon, 26 Nov 2018 20:53:41 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-the-following-query-using-the-coalesce/m-p/411815#M118764 pfabrizi 2018-11-26T20:53:41Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-the-following-query-using-the-coalesce/m-p/411816#M118765 <P>you can add <CODE>| replace "-" with "" in subjectuser</CODE> before coalesce</P> Mon, 26 Nov 2018 21:14:21 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-the-following-query-using-the-coalesce/m-p/411816#M118765 Vijeta 2018-11-26T21:14:21Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-the-following-query-using-the-coalesce/m-p/411817#M118766 <P>You can use this:</P> <PRE><CODE>EVAL-subjectuser=if(subjectuser=="-", targetuser, subjectuser) </CODE></PRE> <P>Or in search SPL, this:</P> <PRE><CODE>| eval subjectuser=if(subjectuser=="-", targetuser, subjectuser) </CODE></PRE> Mon, 26 Nov 2018 21:41:59 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-the-following-query-using-the-coalesce/m-p/411817#M118766 woodcock 2018-11-26T21:41:59Z