All Apps and Add-ons

SA-cim_validator: Why is this eval expression producing message "found 1 unexpected values (?)"

Path Finder

Hello,

Can anyone explain to me what the below syntax signifies? While validating data audit logs to CIM validator, one of the fields is saying 1 unexpected value:
alt text

When I checked in Settings->DataModels->Authetication Object; I found the eval expresssion for src as below:

if(isnull(src) OR src="","unknown",src)

What does the above syntax represent, and how can I eliminate the error found 1 unexpected values(?) to expected values.

0 Karma

Esteemed Legend

It is a silly way of ensuring that src is non-null (has a value). Try this instead:

coalesce(src, "unknown")
0 Karma

Path Finder

Thanks!!
I have tried with the below combination :

if(isnull(src) OR src=='?',"unknown",src)

The result is coming correct but again replaces other values also as unknown. Is it something it is considering '?' as regex value and if yes how we can nullify it and consider as the value of src.

0 Karma

Path Finder

Thanks!! However , I want to replace value of src = ? to unknown and for that I wrote the expression as like this:

if(isnull(src) OR src="?","unknown",src) ; however it is taking the value but it replaces all other src values to unknown too. e.g if src = 172.*.*.* any IP address; it also replaces to unknown.

I tried with other way also ; but same result I am getting.

if(isnull(src) OR src=="\?","unknown",src)
if(isnull(src) OR src=="?","unknown",src)

Basically, I want only value "?" should be replaced with unknown.

If anyone can tell, it would be really help. Thanks in advance.

0 Karma

Esteemed Legend

Try this:

if((isnull(src) OR like(src,"?")), "unknown", src)
0 Karma

Esteemed Legend

This one should definitely do it.

0 Karma

Path Finder

Thank You so much!! However , it is also not giving the desired result.

Is it something that the null value can only be replaced in raw data ? I am not sure though.

0 Karma

SplunkTrust
SplunkTrust

Have you tried

if(isnull(src) OR src=='?',"unknown",src)
0 Karma