https://community.splunk.com/t5/Splunk-Search/how-to-display-raw-result-if-no-specific-result-is-available/m-p/52335#M12712 <P>my final search looks like:</P> <P>index=sonicwall app=* "Connection Closed" | stats sum(sent) sum(rcvd) by dst_ip app | lookup sonicwall_app_id app_id as app OUTPUT app_name | eval "Application" = coalesce(app_name, app) | fields dst_ip, "Application", sum(sent), sum(rcvd) | rename dst_ip as "Destination" | rename sum(sent) as "Sent Bytes" | rename sum(rcvd) as "Received Bytes"</P> Mon, 28 Sep 2020 14:41:34 GMT jalfrey 2020-09-28T14:41:34Z https://community.splunk.com/t5/Splunk-Search/how-to-display-raw-result-if-no-specific-result-is-available/m-p/52332#M12709 <P>I'm doing a pretty basic search which looks for a "connection closed" message and displays a variable called app. I have an automatic lookup which converts the app value to an application name. Not all of the values can be looked up in my lookup table. How do I run a search and display the application name (app_name) and if that's not available then display the app (numeric value)? </P> <P>Here is the search I have made that calculates bytes sent/received and displays bot the app name and the app numeric value. </P> <P>app=* "Connection Closed" | stats sum(sent) sum(rcvd) by dst_ip app | lookup sonicwall_app_id app_id as app OUTPUT app_name as Application | fields dst_ip, Application, app, sum(sent), sum(rcvd) | rename dst_ip as "Destination IP" | rename app to "App ID" | rename sum(sent) as "Bytes Sent" | rename sum(rcvd) as "Bytes Received"</P> Mon, 28 Sep 2020 14:41:26 GMT https://community.splunk.com/t5/Splunk-Search/how-to-display-raw-result-if-no-specific-result-is-available/m-p/52332#M12709 jalfrey 2020-09-28T14:41:26Z https://community.splunk.com/t5/Splunk-Search/how-to-display-raw-result-if-no-specific-result-is-available/m-p/52333#M12710 <P>Create a field that uses either the app_name if it's not null, otherwise use app_id:</P> <PRE><CODE>... | eval yournewfield = coalesce(app_name, app_id) | ... </CODE></PRE> Mon, 28 Sep 2020 14:41:29 GMT https://community.splunk.com/t5/Splunk-Search/how-to-display-raw-result-if-no-specific-result-is-available/m-p/52333#M12710 Ayn 2020-09-28T14:41:29Z https://community.splunk.com/t5/Splunk-Search/how-to-display-raw-result-if-no-specific-result-is-available/m-p/52334#M12711 <P>that worked great! Thanks.</P> Fri, 30 Aug 2013 22:08:25 GMT https://community.splunk.com/t5/Splunk-Search/how-to-display-raw-result-if-no-specific-result-is-available/m-p/52334#M12711 jalfrey 2013-08-30T22:08:25Z https://community.splunk.com/t5/Splunk-Search/how-to-display-raw-result-if-no-specific-result-is-available/m-p/52335#M12712 <P>my final search looks like:</P> <P>index=sonicwall app=* "Connection Closed" | stats sum(sent) sum(rcvd) by dst_ip app | lookup sonicwall_app_id app_id as app OUTPUT app_name | eval "Application" = coalesce(app_name, app) | fields dst_ip, "Application", sum(sent), sum(rcvd) | rename dst_ip as "Destination" | rename sum(sent) as "Sent Bytes" | rename sum(rcvd) as "Received Bytes"</P> Mon, 28 Sep 2020 14:41:34 GMT https://community.splunk.com/t5/Splunk-Search/how-to-display-raw-result-if-no-specific-result-is-available/m-p/52335#M12712 jalfrey 2020-09-28T14:41:34Z https://community.splunk.com/t5/Splunk-Search/how-to-display-raw-result-if-no-specific-result-is-available/m-p/52336#M12713 <P>+1 on a nice use of coalesce!</P> Fri, 30 Aug 2013 22:22:41 GMT https://community.splunk.com/t5/Splunk-Search/how-to-display-raw-result-if-no-specific-result-is-available/m-p/52336#M12713 Rob 2013-08-30T22:22:41Z