topic Use field A if B does not exist in Splunk Search

Use field A if B does not exist

HeinzWaescher — Mon, 17 Feb 2014 08:53:27 GMT

Hi,

in the past I used a lookup to add the field "price" to my events.
Now there will be a new field "price II" in the eventstructure. In the statistics I would like to tell Splunk to use "price II" if it exists, otherwise use "price"

My idea would be to create a new field "final_price" and use this field for further calculations. But I've no idea what kind of function should be used.

| eval final_price=...

Thanks in advance

Heinz

Re: Use field A if B does not exist

MuS — Mon, 17 Feb 2014 09:44:43 GMT

Hi HeinzWaescher,

check the isnotnull() or where function for eval, so you could use something like this:

 YourSearchHere | eval final_price=if(isnotnull(price II),price II,price)

But I'm not sure if this will work for you, because you're using a space in the fieldname. You should avoid spaces in field names and use _ or - instead.

hope this helps ...

cheers, MuS

Re: Use field A if B does not exist

alacercogitatus — Mon, 17 Feb 2014 12:10:41 GMT

Splunk has a habit of replacing Spaces with underscores. Your field will probably be "price_II".

Re: Use field A if B does not exist

martin_mueller — Mon, 17 Feb 2014 12:41:51 GMT

Here's a shorter version:

... | eval final_price=coalesce(price_II,price) | ..

Re: Use field A if B does not exist

HeinzWaescher — Wed, 19 Feb 2014 09:49:13 GMT

Hey,

this works fine! There is no space in the fieldname, it was just a bad example 😉

Thanks!

Re: Use field A if B does not exist

HeinzWaescher — Wed, 19 Feb 2014 09:50:25 GMT

This command works fine as well. Thanks!