All Apps and Add-ons

Splunk DB Connect: Create a New Field based on an existing fields value at ingestion time

jerrythoms
Explorer

New to Splunk and dbx connect 3.1. I have it mostly working , just one issue. I have a field, lets call it Name, if its value is Null, I want to have a new field called Name_status given the value "no name" and if it has a value I want to change it to "Has name". I want this to be done as the data is being ingested

been trying the case command and the nonull command but I get parameter #1 has not been set every time . Stuff I have tried

CASE WHEN len(Name)>0 then 'Has Name" as Name_status

CASE WHEN Name is not null then Name_status="Has Name"

0 Karma
1 Solution

FritzWittwer_ol
Contributor

I would solve this in the SQL query which gets the data. During ingestion you can do this only with a transforms using a regex

View solution in original post

0 Karma

FritzWittwer_ol
Contributor

I would solve this in the SQL query which gets the data. During ingestion you can do this only with a transforms using a regex

0 Karma

jerrythoms
Explorer

Thanks for your comments. Yes I want to do this in the SQL query that is in the DBX input. I just can't seem to get it to work.

0 Karma

harsmarvania57
Ultra Champion

Hi @jerrythoms,

May I ask you, why you want to create a new field during ingestion time ? You can create new field during search time like <yourBasesearch> | eval Name_status=if(Name="","No Name","Has Name") so this will create new field Name_status with values No Name and Has Name

0 Karma

jerrythoms
Explorer

Due to an upgrade the data that is already in the index has the field and all the dashboards use the field. Just thinking it would be easier to do this rather than change all the dashboards. Thanks for your comments.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...