Getting Data In

How to create an eval for a field if it does not exist?

mjuestel2
Path Finder

I am in the process of normalizing data, so I can apply it to a data model. One of the fields which is having issues is called user.

I have user data in some logs, while other logs have an empty user field - but do have data in a src_user field.

Tried using the coalesce command - but that does not seem to work.

EVAL-user = coalesce(user, src_user)

 

Is it because I am trying to reference the user field? 

Are there any other work arounds to create a user field when it is empty and filling data from src_user ? Remember, some logs have valid data in the user field. Others have no data.

 

Thanks!

 

 

 

 

 

 

 

 

Labels (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

It is likely that it is already done correctly for you if this is typical Enterprise software generating the data and you have the matching TAs installed everywhere.  In other words, "src_user" and "user" are typically different because it is "src_user" (e.g. "admin") doing something TO some other "user".  In any case, the reason that your calculated search is not working is because of this:
https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Searchtimeoperationssequence

View solution in original post

Tags (1)

woodcock
Esteemed Legend

It is likely that it is already done correctly for you if this is typical Enterprise software generating the data and you have the matching TAs installed everywhere.  In other words, "src_user" and "user" are typically different because it is "src_user" (e.g. "admin") doing something TO some other "user".  In any case, the reason that your calculated search is not working is because of this:
https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Searchtimeoperationssequence

Tags (1)

gcusello
SplunkTrust
SplunkTrust

Hi @mjuestel2,

to normalize the src_user field from the user field you can use an alias field (this is the usual approach to missing fields or fields with a wrong name).

If instead there are some events that have the src_user and some others that don't have it, you can use the coalesce option in eval.

If it doesan't run, you can use a calculated field like the following:

| eval src_user=if(isnull(src_user),user,src_user)

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...