https://community.splunk.com/t5/Splunk-Search/setting-field-values/m-p/68627#M17224 <P>Use <A href="http://www.splunk.com/base/Documentation/4.2/SearchReference/CommonEvalFunctions" rel="nofollow">coalesce</A>:</P> <PRE><CODE>| eval prefix=coalesce(prefix,"033") </CODE></PRE> <P>or alternateively, edit your <A href="http://www.splunk.com/base/Documentation/latest/User/CreateAndConfigureFieldLookups#Include_advanced_options" rel="nofollow">lookup table</A> definition to to return a default value.</P> Sun, 27 Mar 2011 22:04:23 GMT southeringtonp 2011-03-27T22:04:23Z https://community.splunk.com/t5/Splunk-Search/setting-field-values/m-p/68626#M17223 <P>Hi guys,</P> <P>how doi go about setting a field value if it is empty...</P> <P>I have a field prefix... i use this field when i do a lookup to a csv file... in certain events the field prefix is empty "" and in those cases i would like to set it to 033 so it matches the lookup...</P> <P>i tried using eval prefix=if(prefix="","033",prefix) but this does not work...</P> <P>any ideas</P> Sun, 27 Mar 2011 21:47:45 GMT https://community.splunk.com/t5/Splunk-Search/setting-field-values/m-p/68626#M17223 kenchisho 2011-03-27T21:47:45Z https://community.splunk.com/t5/Splunk-Search/setting-field-values/m-p/68627#M17224 <P>Use <A href="http://www.splunk.com/base/Documentation/4.2/SearchReference/CommonEvalFunctions" rel="nofollow">coalesce</A>:</P> <PRE><CODE>| eval prefix=coalesce(prefix,"033") </CODE></PRE> <P>or alternateively, edit your <A href="http://www.splunk.com/base/Documentation/latest/User/CreateAndConfigureFieldLookups#Include_advanced_options" rel="nofollow">lookup table</A> definition to to return a default value.</P> Sun, 27 Mar 2011 22:04:23 GMT https://community.splunk.com/t5/Splunk-Search/setting-field-values/m-p/68627#M17224 southeringtonp 2011-03-27T22:04:23Z