Splunk DB Connect: Create a New Field based on an existing fields value at ingestion time

[jerrythoms]

New to Splunk and dbx connect 3.1. I have it mostly working , just one issue. I have a field, lets call it Name, if its value is Null, I want to have a new field called Name_status given the value "no name" and if it has a value I want to change it to "Has name". I want this to be done as the data is being ingested

been trying the case command and the nonull command but I get parameter #1 has not been set every time . Stuff I have tried

CASE WHEN len(Name)>0 then 'Has Name" as Name_status

CASE WHEN Name is not null then Name_status="Has Name"

[FritzWittwer · Accepted solution]

I would solve this in the SQL query which gets the data. During ingestion you can do this only with a transforms using a regex

[jerrythoms]

Thanks for your comments. Yes I want to do this in the SQL query that is in the DBX input. I just can't seem to get it to work.

[harsmarvania57]

Hi @jerrythoms,

May I ask you, why you want to create a new field during ingestion time ? You can create new field during search time like <yourBasesearch> | eval Name_status=if(Name="","No Name","Has Name") so this will create new field Name_status with values No Name and Has Name

[jerrythoms]

Due to an upgrade the data that is already in the index has the field and all the dashboards use the field. Just thinking it would be easier to do this rather than change all the dashboards. Thanks for your comments.