topic Re: Set Field=Value when Field not present in some logs in Splunk Search

Set Field=Value when Field not present in some logs

bcarr12 — Thu, 03 Aug 2017 14:10:50 GMT

Hi all,

I am running a search that in some cases has:
Field=Values

In other cases, Field is completely missing from logs (this is expected).

What would be the best way to set Field equal to the Value when one is present, but if the Field does not exist in a given log line, Field should be set to the word "none"?

I've tried the coalesce command, but it doesn't seem to be working - maybe it is just being used incorrectly?
eval NewField=coalesce(Field,"none")

In the above example, NewField is always equal to "none" - even when Field includes a value.

Re: Set Field=Value when Field not present in some logs

cmerriman — Thu, 03 Aug 2017 14:23:32 GMT

try this:

|eval Field=if(isnull(Field),"none",Field)

Re: Set Field=Value when Field not present in some logs

alemarzu — Thu, 03 Aug 2017 14:25:23 GMT

Heya, or try this.

... | fillnull value=none field1,field2,field3

Re: Set Field=Value when Field not present in some logs

bcarr12 — Thu, 03 Aug 2017 14:46:52 GMT

Thank you both for your suggestions! alemarzu, fillnull worked great for this!