Getting Data In

How to create an eval for a field if it does not exist?

mjuestel2
Path Finder

I am in the process of normalizing data, so I can apply it to a data model. One of the fields which is having issues is called user.

I have user data in some logs, while other logs have an empty user field - but do have data in a src_user field.

Tried using the coalesce command - but that does not seem to work.

EVAL-user = coalesce(user, src_user)

 

Is it because I am trying to reference the user field? 

Are there any other work arounds to create a user field when it is empty and filling data from src_user ? Remember, some logs have valid data in the user field. Others have no data.

 

Thanks!

 

 

 

 

 

 

 

 

Labels (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

It is likely that it is already done correctly for you if this is typical Enterprise software generating the data and you have the matching TAs installed everywhere.  In other words, "src_user" and "user" are typically different because it is "src_user" (e.g. "admin") doing something TO some other "user".  In any case, the reason that your calculated search is not working is because of this:
https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Searchtimeoperationssequence

View solution in original post

Tags (1)

woodcock
Esteemed Legend

It is likely that it is already done correctly for you if this is typical Enterprise software generating the data and you have the matching TAs installed everywhere.  In other words, "src_user" and "user" are typically different because it is "src_user" (e.g. "admin") doing something TO some other "user".  In any case, the reason that your calculated search is not working is because of this:
https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Searchtimeoperationssequence

Tags (1)

gcusello
SplunkTrust
SplunkTrust

Hi @mjuestel2,

to normalize the src_user field from the user field you can use an alias field (this is the usual approach to missing fields or fields with a wrong name).

If instead there are some events that have the src_user and some others that don't have it, you can use the coalesce option in eval.

If it doesan't run, you can use a calculated field like the following:

| eval src_user=if(isnull(src_user),user,src_user)

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...