All Apps and Add-ons

Splunk DB Connect: Create a New Field based on an existing fields value at ingestion time

jerrythoms
Explorer

New to Splunk and dbx connect 3.1. I have it mostly working , just one issue. I have a field, lets call it Name, if its value is Null, I want to have a new field called Name_status given the value "no name" and if it has a value I want to change it to "Has name". I want this to be done as the data is being ingested

been trying the case command and the nonull command but I get parameter #1 has not been set every time . Stuff I have tried

CASE WHEN len(Name)>0 then 'Has Name" as Name_status

CASE WHEN Name is not null then Name_status="Has Name"

0 Karma
1 Solution

FritzWittwer_ol
Contributor

I would solve this in the SQL query which gets the data. During ingestion you can do this only with a transforms using a regex

View solution in original post

0 Karma

FritzWittwer_ol
Contributor

I would solve this in the SQL query which gets the data. During ingestion you can do this only with a transforms using a regex

0 Karma

jerrythoms
Explorer

Thanks for your comments. Yes I want to do this in the SQL query that is in the DBX input. I just can't seem to get it to work.

0 Karma

harsmarvania57
Ultra Champion

Hi @jerrythoms,

May I ask you, why you want to create a new field during ingestion time ? You can create new field during search time like <yourBasesearch> | eval Name_status=if(Name="","No Name","Has Name") so this will create new field Name_status with values No Name and Has Name

0 Karma

jerrythoms
Explorer

Due to an upgrade the data that is already in the index has the field and all the dashboards use the field. Just thinking it would be easier to do this rather than change all the dashboards. Thanks for your comments.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...