topic How to add values from a split to an existing field? in Splunk Search

How to add values from a split to an existing field?

fatanyk — Tue, 03 Jan 2023 16:08:54 GMT

Hello, i'm trying to add values to an existing field but i'm running into a wall.

I have a field name vector and another field name source, the pattern of the source field is XXX - YYY - ZZZ,

i only want to keep the XXX part, so i've done

| eval temp = mvindex(split(source, " - "),0)

then i try to add these result to the vector field like this :

|eval vector = vector + temp

but it doesn't work.

Can you help me ?

Re: How to add values from a split to an existing field

goncalocoelho — Tue, 03 Jan 2023 13:03:44 GMT

Hi,

Do you know for sure if the source field exists in 100% of the events? Sometimes concatenating fields fails because one of the fields doesn't exist on all events.

Try this:

| eval vector = if(isnull(temp), vector, vector.temp)

Also try to concatenate using the "." instead of "+"

| eval vector = vector.temp

---
If this reply helps you, Karma would be appreciated.

Re: How to add values from a split to an existing field

fatanyk — Tue, 03 Jan 2023 13:40:10 GMT

No, the source field does not exist in 100% of the events, in fact I want to create the field "vector" for the events that do not have it with the value XXX.

i've try both of your solutions but neither worked.

Re: How to add values from a split to an existing field

goncalocoelho — Tue, 03 Jan 2023 14:33:05 GMT

If vector doesn't exist, and you are creating it based on source, then try this:

| eval vector = if(isnull(temp), "<null or something else>", temp)

---
If this reply helps you, Karma would be appreciated.

Re: How to add values from a split to an existing field

fatanyk — Tue, 03 Jan 2023 15:51:30 GMT

it works thank you !

Actually it looks like this :

| eval vector= if(isnull(temp),vector,temp)