SA-cim_validator: Why is this eval expression producing message "found 1 unexpected values (?)"

[bagarwal]

Hello,

Can anyone explain to me what the below syntax signifies? While validating data audit logs to CIM validator, one of the fields is saying 1 unexpected value:

When I checked in Settings->DataModels->Authetication Object; I found the eval expresssion for src as below:

if(isnull(src) OR src="","unknown",src)

What does the above syntax represent, and how can I eliminate the error found 1 unexpected values(?) to expected values.

[woodcock]

It is a silly way of ensuring that src is non-null (has a value). Try this instead:

coalesce(src, "unknown")

[bagarwal]

Thanks!!
I have tried with the below combination :

if(isnull(src) OR src=='?',"unknown",src)

The result is coming correct but again replaces other values also as unknown. Is it something it is considering '?' as regex value and if yes how we can nullify it and consider as the value of src.

[bagarwal]

Thanks!! However , I want to replace value of src = ? to unknown and for that I wrote the expression as like this:

if(isnull(src) OR src="?","unknown",src) ; however it is taking the value but it replaces all other src values to unknown too. e.g if src = 172.*.*.* any IP address; it also replaces to unknown.

I tried with other way also ; but same result I am getting.

if(isnull(src) OR src=="\?","unknown",src)
if(isnull(src) OR src=="?","unknown",src)

Basically, I want only value "?" should be replaced with unknown.

If anyone can tell, it would be really help. Thanks in advance.

[woodcock]

Try this:

if((isnull(src) OR like(src,"?")), "unknown", src)

[woodcock]

This one should definitely do it.

[bagarwal]

Thank You so much!! However , it is also not giving the desired result.

Is it something that the null value can only be replaced in raw data ? I am not sure though.

[MuS]

Have you tried

if(isnull(src) OR src=='?',"unknown",src)