Adding field to event without altering existing field

phamxuantung — Tue, 20 Apr 2021 09:53:24 GMT

I have an index that have a field called ISSUER_NAME, but now we have a new set of events (different log structure) that don't have that ISSUER_NAME but identify by another field. I want to add ISSUER_NAME to that specific event. I tried

eval ISSUER_NAME = if(TXN="33","XXX",ISSUER_NAME)

In which, TXN="33" is the identifier to those events, XXX is the content of the ISSUER_NAME I want to give to said events, which they don't have. But if I do that, the ISSUER_NAME of old events structure return NULL. I want to ask, is there a way to add field to events without altering existing field?
Thank you.

Re: Adding field to event without altering existing field

ITWhisperer — Tue, 20 Apr 2021 10:04:00 GMT

eval ISSUER_NAME = if(isnull(ISSUER_NAME),if(TXN="33","XXX","N/A"),ISSUER_NAME)

eval ISSUER_NAME = coalesce(ISSUER_NAME, if(TXN="33","XXX","N/A"))

topic Re: Adding field to event without altering existing field in Splunk Search

Adding field to event without altering existing field

Re: Adding field to event without altering existing field