How to Field extraction / Calculated fields

[VijaySrrie]

Hi,

Need one field to be extracted or need a calculated field

I have two fields that are auto-extracted (action and Severity)
Values of action field = read, debug, modify
Values of Severity field = SUCCESS and FAILURE

Out of 100 logs 50 logs are having action field

All logs are having Severity field

Wherever action field is available in the logs, I want the same value, when there is no action field, I want the value of Severity to be disabled under action field


NOTE: For all the logs Index/Sourcetype and source are same

[VijaySrrie]

| eval action=if(isnull(action),severity,action)

It worked with this statement

[ITWhisperer]

Yes, that is essentially what coalesce is doing 😀

[ITWhisperer]

Is this what you mean?

| makeresults count=10
| eval action=mvindex(split("read|debug|modify","|"), random()%6)
| eval Severity=mvindex(split("SUCCESS|FAILURE","|"),random()%2)
``` If action is not present, use value from Severity ```
| eval action=coalesce(action,Severity)