topic Re: How to create a conditional eval to fill a new field depending on other fields? in Splunk Search

How to create a conditional eval to fill a new field depending on other fields?

lyds — Wed, 29 Aug 2018 09:46:46 GMT

Hello,
I want to create a new field that will take the value of other fields depending of which one is filled.

For example, I have 5 fields but only one can be filled at a time. The other fields don't have any value.

Field1:
Field2:
Field3:
Field4: Ok
Field5:

How can I write the eval to check if a field1 is null, take the value of the following field2, if it is also null, take the value of field3 until it reaches the not null field?

Thank you.

Re: How to create a conditional eval to fill a new field depending on other fields?

inventsekar — Wed, 29 Aug 2018 12:05:09 GMT

//// I have 5 fields but only one can be filled at a time. The other fields don't have any value ////
In your search use the fillnull command and assign a value to that field when it is null, then count that value for the field.

search Field="*" | fillnull value=NULL | stats count by Field | where count=1

Updated - with coalesce, try this one..

search Field="*" | eval NewField=coalesce(Field1, Field2, Field3, Field4, Field5) | eval result=if(NewField="Ok", "all good", "some fields are not null")

Re: How to create a conditional eval to fill a new field depending on other fields?

skoelpin — Wed, 29 Aug 2018 12:09:19 GMT

Try this. The new field name will be called NewField and assumes your field name is field

| eval NewField=if(isnull(Field),"null",'Field')

Re: How to create a conditional eval to fill a new field depending on other fields?

inventsekar — Wed, 29 Aug 2018 13:12:47 GMT

Hi @skoelpin ... i think you missed the 5 fields part of the question..
--- I have 5 fields but only one can be filled at a time. The other fields don't have any value.

Re: How to create a conditional eval to fill a new field depending on other fields?

skoelpin — Wed, 29 Aug 2018 13:51:07 GMT

It's the same exact logic with a case statement...

Re: How to create a conditional eval to fill a new field depending on other fields?

RHASQaL — Thu, 30 Aug 2018 08:05:13 GMT

I think I'd use the coalesce eval function. It's description is 'This function takes an arbitrary number of arguments and returns the first value that is not NULL.'

Re: How to create a conditional eval to fill a new field depending on other fields?

inventsekar — Thu, 30 Aug 2018 09:26:03 GMT

with coalesce, try this one..
search Field="*" | eval NewField=coalesce(Field1, Field2, Field3, Field4, Field5) | eval result=if(NewField="Ok", "all good", "some fields are not null")

Re: How to create a conditional eval to fill a new field depending on other fields?

nawazns5038 — Thu, 30 Aug 2018 21:34:23 GMT

Try coalesce command

eval new_field=coalesce(Field1,Field2,....)

https://www.splunk.com/blog/2014/03/21/search-command-coalesce.html

Re: How to create a conditional eval to fill a new field depending on other fields?

lyds — Fri, 31 Aug 2018 11:50:54 GMT

I've used coalesce command, and I get what I wanted to display!

Thanks you all for the help!

Re: How to create a conditional eval to fill a new field depending on other fields?

richgalloway — Fri, 31 Aug 2018 12:27:17 GMT

@lyds, If your problem is resolved, please accept an answer to help future readers.