https://community.splunk.com/t5/Splunk-Search/How-to-populate-a-null-field-if-certain-field-equals/m-p/483837#M135459 <P>Should there be at the end “,1=1, dest_port)” ?</P> Thu, 27 Feb 2020 20:59:52 GMT isoutamo 2020-02-27T20:59:52Z https://community.splunk.com/t5/Splunk-Search/How-to-populate-a-null-field-if-certain-field-equals/m-p/483835#M135457 <P>Hi Folks</P> <P>Have an issue where some of my log entries contain null fields in which i need to populate in order to run stats against.</P> <P>From the csv dump below, dest_port is empty so i need to basically say:</P> <P>where rule=SSH-ACL, polulate empty dest_port field with a value of 22<BR /> where rule=NTP-ACL, polulate empty dest_port field with a value of 123</P> <P>thanks in advance.</P> <P><IMG src="https://community.splunk.com/storage/temp/284602-splunkpost.jpg" alt="alt text" /></P> Wed, 30 Sep 2020 04:25:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-populate-a-null-field-if-certain-field-equals/m-p/483835#M135457 smithjnick 2020-09-30T04:25:39Z https://community.splunk.com/t5/Splunk-Search/How-to-populate-a-null-field-if-certain-field-equals/m-p/483836#M135458 <P>Try <CODE>case</CODE>.</P> <PRE><CODE>... | eval dest_port = case (rule=SSH-ACL AND isnull(dest_port), 22, rule=NTP-ACL AND isnull(dest_port), 123, 1==1, dest_port) </CODE></PRE> Thu, 27 Feb 2020 20:55:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-populate-a-null-field-if-certain-field-equals/m-p/483836#M135458 richgalloway 2020-02-27T20:55:37Z https://community.splunk.com/t5/Splunk-Search/How-to-populate-a-null-field-if-certain-field-equals/m-p/483837#M135459 <P>Should there be at the end “,1=1, dest_port)” ?</P> Thu, 27 Feb 2020 20:59:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-populate-a-null-field-if-certain-field-equals/m-p/483837#M135459 isoutamo 2020-02-27T20:59:52Z https://community.splunk.com/t5/Splunk-Search/How-to-populate-a-null-field-if-certain-field-equals/m-p/483838#M135460 <P>Yes. Updated.</P> Thu, 27 Feb 2020 21:24:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-populate-a-null-field-if-certain-field-equals/m-p/483838#M135460 richgalloway 2020-02-27T21:24:03Z https://community.splunk.com/t5/Splunk-Search/How-to-populate-a-null-field-if-certain-field-equals/m-p/483839#M135461 <P>Thank you Rich.</P> <P>Not currently giving me the desired output but the case command has now given me some food for thought. Thank you for the pointer and will report back with my outcome.</P> <P>cheers</P> Fri, 28 Feb 2020 12:07:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-populate-a-null-field-if-certain-field-equals/m-p/483839#M135461 smithjnick 2020-02-28T12:07:52Z https://community.splunk.com/t5/Splunk-Search/How-to-populate-a-null-field-if-certain-field-equals/m-p/483840#M135462 <P>Well, I'd use this slightly modified version</P> <PRE><CODE> ... | eval dest_port = case (rule="SSH-ACL" AND isnull(dest_port), 22, rule="NTP-ACL" AND isnull(dest_port), 123, 1==1, dest_port) </CODE></PRE> Fri, 28 Feb 2020 13:35:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-populate-a-null-field-if-certain-field-equals/m-p/483840#M135462 jpalacian 2020-02-28T13:35:39Z https://community.splunk.com/t5/Splunk-Search/How-to-populate-a-null-field-if-certain-field-equals/m-p/483841#M135463 <P>Yep JP - that fixed the issue - those damn quotation marks.</P> <P>thank you muchly and have a great weekend.</P> Fri, 28 Feb 2020 13:48:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-populate-a-null-field-if-certain-field-equals/m-p/483841#M135463 smithjnick 2020-02-28T13:48:50Z