topic Re: Help with replacing values in Splunk Search

Help with replacing values

jameskerivan — Wed, 14 Oct 2015 23:40:13 GMT

Hi,

I have my output I was looking for, but was wondering if there was a cleaner way to do it. Basically I have a field like such f1||f2||f3||f4. f2 and f3 can be null in some cases. If they are null I wanted to replace them with my own string. right now i have this as my query.

rex field=transaction_type "(?<TransferType>.)||(?<FromAcct>.)||(?<ToAcct>.)||(?<When>.)"
| eval FromAcct = if(FromAcct="null", "Non" ,FromAcct)
| eval ToAcct = if(ToAcct="null", "Non" ,ToAcct)
| stats count by TransferType, FromAcct, ToAcct, When
| sort count desc

Now I dont like that i have two evals cases where I use if. I wanted to use eval case but wasn't able to get it to work because of how I parse my field.

Thanks for the help!

Thanks!

Re: Help with replacing values

gcato — Wed, 14 Oct 2015 23:45:30 GMT

Hi jameskerivan,

Have you seen the fillnull command. it can replace nulls with a value. Refer to: http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/Fillnull

Hope this helps.

Re: Help with replacing values

aljohnson_splun — Wed, 14 Oct 2015 23:46:57 GMT

Yeah, but he is matching a literal string null - the values aren't actually null, they're filled with a literal value, which just happens to be the string, null. So the fillnull command sadly won't work here.

Re: Help with replacing values

gcato — Tue, 29 Sep 2020 07:37:25 GMT

Yes, very true. I'd suggest the rex command then.
...| rex mode=sed field=_raw "s/null/Non/g" |rex field=transaction_type ...
Note: Must happen before the rex field extraction

Re: Help with replacing values

woodcock — Thu, 15 Oct 2015 00:08:04 GMT

Like this:

rex field=transaction_type "(?<TransferType>.)||(?<FromAcct>.)||(?<ToAcct>.)||(?<When>.)"
| replace "null" WITH "Non" IN ToAcct FromAcct
| stats count by TransferType, FromAcct, ToAcct, When
| sort count desc

Re: Help with replacing values

jameskerivan — Thu, 15 Oct 2015 17:36:55 GMT

Thank you!