topic Quick Question: eval in Splunk Search

Quick Question: eval

wyang6 — Fri, 27 May 2011 22:25:22 GMT

I have a chart:

Los Angeles   New York   Boston   Washington D.C.   Total
5             3                   2                 10

and

... | eval "x"='New York'+'Washington D.C'

returns x=5. However,

... | eval "x"='New York'+'Boston'+'Washington D.C'

returns an empty value, i.e. x=

How do I get around this problem where 'Boston' is empty?

Thank you.

gkanapathy — Fri, 27 May 2011 22:44:56 GMT

use the ifisnull() or coalesce() function:

... | eval "x"=coalesce('New York',0)+coalesce('Boston',0)+ifisnull('Washington D.C',0,'Washington D.C')

Or you could use the | fillnull search command.

bwooden — Fri, 27 May 2011 22:48:01 GMT

I had

... | fillnull value=0 'Los Angeles' 'New York' 'Boston' 'Washington D.C.' | eval x='New York'+'Boston'+'Washington D.C'