topic Mvappend or Mvjoin only to fill blank spaces? in Splunk Search

Mvappend or Mvjoin only to fill blank spaces?

PTC_ — Mon, 06 Mar 2023 14:55:38 GMT

Hello,

I want to append the results from one field to another, however, I only want to fill the null and blank spaces of the field. For this I tried the following:

| eval FIELD2= if(isnull(FIELD1) OR FIELD1="",mvappend(FIELD2,FIELD1),"")

What happens is that it will substitute the filled slots from FIELD2 with "", so it doesn't do what I need.

Is there any solution for this?

Re: Mvappend or Mvjoin only to fill blank spaces

richgalloway — Sun, 05 Mar 2023 21:19:32 GMT

The eval command is doing what you told it to do - replace FIELD2 with an empty string if FIELD1 is not null or empty.

Before we can suggest an alternative command, please clarify the use case. Using concrete, sanitized examples, please show what the output should be given some sample inputs.

Re: Mvappend or Mvjoin only to fill blank spaces

PTC_ — Sun, 05 Mar 2023 21:26:40 GMT

Let's say both fields look like this:

FIELD1	FIELD2
	INFO2
	INFO3
INFO1	INFO4

I want to append, for example, INFO2 and INFO3 to the blank spaces in FIELD1 and the command does that.
However, since "INFO1" fails the condition, it will be replaced with empty string, which I don't want to. The end result will look like this:

FIELD1	FIELD2
INFO2	INFO2
INFO3	INFO3
	INFO4

In the end, I only want to fill FIELD1 blank spaces with FIELD2 information.

Re: Mvappend or Mvjoin only to fill blank spaces

yuanliu — Sun, 05 Mar 2023 23:35:40 GMT

As @richgalloway said, your illustrated code is trying to set FIELD2, as opposed to FIELD1 in your illustrated results. To get your illustrated results, the left-hand side must be FIELD1, not FIELD2.

| eval FIELD1= if(isnull(FIELD1) OR FIELD1="",mvappend(FIELD2,FIELD1),"")

This said, why do you want to mvappend or mvjoin a field (FIELD1) that is verifiably blank? Isn't an assignment of FIELD2 value simpler?

| eval FIELD1= if(isnull(FIELD1) OR FIELD1="", FIELD2,"")

Re: Mvappend or Mvjoin only to fill blank spaces

PTC_ — Sun, 05 Mar 2023 23:42:20 GMT

Maybe I didn't explain it well but anyway I don't wish to obtain those results.
Dunno how can I explain it better but I used this command and it works for what I need to do:

| eval FIELD1= mvjoin(FIELD1,FIELD2)