topic Re: drop null value in Splunk Search

drop null value

riqbal47010 — Mon, 16 Mar 2020 13:39:49 GMT

I have below query
index=f5 partition="/Common/-" | rex "Username\s+'(?(.*))'" | eval Username=coalesce(Username, user)

username is there but first attempt he left empty and in second try he add his username. so the Username is showing null values whereas the default user field is showing actual username.

I am using coalesce because I want to take either value but it should not be null. How can I achieve this.

Re: drop null value

rmmiller — Mon, 16 Mar 2020 15:19:56 GMT

Can you provide a sample event?
It sounds like your regular expression might not be working exactly as you expect.

Re: drop null value

riqbal47010 — Mon, 16 Mar 2020 18:54:30 GMT

attaching for your kind consideration

Re: drop null value

riqbal47010 — Mon, 16 Mar 2020 18:54:41 GMT

Re: drop null value

riqbal47010 — Mon, 16 Mar 2020 18:54:41 GMT

Re: drop null value

manjunathmeti — Mon, 16 Mar 2020 20:12:16 GMT

Function coalesce assigns the value of user field only if Username field does not exist in that event. But here it is set as empty string (""). Use if instead. below will sets value to user if Username is blank else sets to Username.

index=f5 partition="/Common/-" | rex "Username\s+'(?<Username>.*)'"| eval Username=if(Username == "",  user, Username)

Re: drop null value

to4kawa — Mon, 16 Mar 2020 21:29:56 GMT

index=f5 partition="/Common/-" 
| rex "Username\s+'(?<Username>\w+)'" 
| eval Username=coalesce(Username, user)

your REGEX .* match null value.
How about this?
If Username has -, REGEX is [\w\-]+.