topic using map and if/isnull but missing fields in base is causing failure in Splunk Search

using map and if/isnull but missing fields in base is causing failure

milidna13 — Sun, 03 Feb 2019 14:32:37 GMT

hi could someone please help me out here. been stuck with a problem. we have multiple existing queries in our environment. i am creating a sort of universal macro to work with the current queries.

the problem is, there are some fields which exists in some of the base queries but doesnt exist in another. how do i do a map in that macro with and if/isnull even with the missing fields.

Example

base search1 below:

| makeresults
| eval field1="abc"
| eval field2="def"

base search2 below:

| makeresults
| eval field1="abc"
| eval field2="def"
| eval field3="opq"
| eval field4="rst"

macro below:

| map [search index=test1...
| eval field1=if(isnull("$field1$"),"","$field1$")
| eval field2=if(isnull("$field2$"),"","$field2$")
| eval field3=if(isnull("$field3$"),"","$field3$")
| eval field4=if(isnull("$field4$"),"","$field4$")]

so the thing is, map will fail for base search1 but working on base search2. is there a way to fix this? there multiple fields in the base query.

thanks!

Re: using map and if/isnull but missing fields in base is causing failure

jvishwak — Mon, 04 Feb 2019 05:30:54 GMT

Can you add a check for blank value as well, try this: | eval field1=if(isnull($field1$) OR field1 = "","",$field1$)

Re: using map and if/isnull but missing fields in base is causing failure

vishaltaneja070 — Mon, 04 Feb 2019 08:22:06 GMT

@milidna13

You need to place a test of fields before map command always. If you are creating a macro then try to do it like this:

  eval field1 = if(isnull(field1),"", field1) | eval field2 = if(isnull(field2),"", field2) | eval field3 = if(isnull(field3),"", field3) | eval field4 = if(isnull(field4),"", field4)
     | map [| eval field1=if(isnull("$field1$"),"","$field1$")
     | eval field2=if(isnull("$field2$"),"","$field2$")
     | eval field3=if(isnull("$field3$"),"","$field3$")
     | eval field4=if(isnull("$field4$"),"","$field4$")  ]

Re: using map and if/isnull but missing fields in base is causing failure

woodcock — Mon, 04 Feb 2019 17:24:31 GMT

Yes, in the base search, end it with this command:

... | fields field1 field2 field3 field4 AND ALSO ANY OTHER FIELDS THAT YOU NEED TO KEEP ALL LISTED OUT HERE