topic Re: Contains "is null" with if command in Splunk Search

Contains "is null" with if command

Shakira1 — Wed, 28 Dec 2022 11:45:14 GMT

I have all_ip filed that contains all my ips.

now I want to split it to public ip and private ip:

public_ip, private_ip, all_ip:

and when private_ip is null I want to put the value from all_ip in public_ip field.

first I did:

| eval private_ip=if(like(all_ip,"XXXX.%") OR like(all_ip,"XXX.%"),all_ip,null())

and now I need to do (all the rest fill it in public_ip field.

this is possible?

thanks!

Manasa_401 — Wed, 28 Dec 2022 11:56:54 GMT

Hello @Shakira1

Try the below line.

| eval public_ip=if(isnull(private_ip),all_ip,"NO")

you can change the value in else as you prefer

If this helps, karma would be appreciated.

Thanks,

Manasa

Shakira1 — Wed, 28 Dec 2022 15:16:39 GMT

thanks!