topic Re: How to replace blank with "NA" while using Rex command in Splunk Search

How to replace blank with "NA" while using Rex command

manojchacko78 — Thu, 26 Oct 2023 09:05:01 GMT

I am extracting these three values and if there is any empty value in any of the fields, it returns as no result.

How i replace the blank values with NA in the rex statements

| rex field=AddtionalData "Business unit:(?<BusinessUnit>[^,]+)"
| rex field=AddtionalData "Location code:(?<Locationcode>[^,]+)"
| rex field=AddtionalData "Job code :(?<Jobcode>[^,]+)"

| stats count by BusinessUnit Locationcode Jobcode
| fields - count

Re: How to replace blank with "NA" while using Rex command

gcusello — Thu, 26 Oct 2023 09:08:50 GMT

Hi @manojchacko78,

you can use fillnull to replace spaces with "NA"

| rex field=AddtionalData "Business unit:(?<BusinessUnit>[^,]+)" | rex field=AddtionalData "Location code:(?<Locationcode>[^,]+)" | rex field=AddtionalData "Job code :(?<Jobcode>[^,]+)" | fillnull value="NA" BusinessUnit | fillnull value="NA" Locationcode | fillnull value="NA" Jobcode | stats count by BusinessUnit Locationcode Jobcode | fields - count

Ciao.

Giuseppe

Re: How to replace blank with "NA" while using Rex command

manojchacko78 — Thu, 26 Oct 2023 11:16:23 GMT

Thanks @gcusello

Perfect, thanks, it worked

Have a nice day